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MEMORANDUM OPINION AND ORDER 


The Foreign Intelligence Surveillance Court today addresses the “Government’s Ex Parte 
Submission of Reauthorization Certifications and Related Procedures, Ex Parte Submission of 
Amended Certifications, and Request for an Order Approving Such Certifications and Amendeil 
Certifications,” filed on March 27, 2018 (“March 27, 2018, Submission”), and the 
“Government’s Ex Parte Submission of Amendments to DNI/AG 702(h) Certifications and 
Related Procedures, Ex Parte Submission of Amendments to DNI/AG 702(g) Certifications, and 
Request for an Order Approving Such Amended Certifications,” filed on September 18, 2018 
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(“September 18, 2018, Submission”). The March 27, 2018, Submission, as amended by the 
September 18, 201 8, Submission, is subject to review by the Court under Section 702 of the 
Foreign Intelligence Surveillance Act (FISA) as amended, codified at 50 U.S.C. § 1881a. The 
government’s request for approval of the amended certifications and related procedures is 
granted in part and denied in part for the reasons stated in this Memorandum Opinion and 
Order. 

Part I «f this Opinion summarizes the government’s submissions and the procedural 
history of these matters. In Part II, the Court finds that the certifications before it contain the 
elements required by Section 702(h). 

Part III of the Opinion addresses the targeting procedures and issues relating to the scope 
of acquisition, including the “abouts limitation” at Section 702(b)(5). The Court finds that the 
targeting procedures satisfy the requirements of the statute and are consistent with the 
requirements of the Fourth Amendment and approves the proposed scope of acquisition. 

The Court examines the querying procedures and minimization procedures in Part IV. 
After reviewing the applicable statutory provisions, see Part IV.A, the Court finds that the FBI’s 
querying procedures do not comply with the requirement at Section 702(f)(1)(B) to keep records 
of U.S.-person query terms used to conduct queries of information acquired under Section 702. 
See Part IV.B. The Court next examines the prevalence of non-compliant queries conducted by 
FBI personnel to return information about U.S. persons from Section 702-acquired data. It 
ultimately finds the FBI’s querying and minimization procedures, as implemented, to be 
inconsistent with statutory minimization requirements and the requirements of the Fourth 
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Amendment. See Part IV.C. The Court then examines and approves certain exemptions that 
appear in each agency’s set of querying and minimization procedures, see Part IV. D, as well as 
certain changes to the FBI’s minimization procedures. See Part IV.E. 

Part V addresses certain other instances of non-compliance and the government’s 
responses thereto. Those instances do not require any further findings of deficiency. In Part VI, 
the Court summarizes its disposition and imposes certain reporting and other requirements on the 
government. 

I. PROCEDURAL HISTORY 

The Court begins with a description of the 201 8 certifications and their amendments ande 
then describes their subject matter. 

A. The 2018 Certifications and Amendments 

The March 27, 2018, Submission includes ^^^ertifications executed by the Attorney 



Each of those certifications (collectively referred to as “the March 27, 2018, Certifications”) is 
accompanied by: 

(1) Supporting affidavits of the Director of the National Security Agency, the Director of e 
the Federal Bureau of Investigation, the Director of the Central Intelligence Agency, ande 
the acting Director of the National Counterterrorism Center;e 

(2) eTwo sets of targeting procedures, which govern NSA and the FBI respectively. Thee 
targeting procedures for NSA appear as Exhibit A to each certification and those for thee 
FBI appear as Exhibit C. The targeting procedures for each certification are identical;e 
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(3) Four sets of minimization procedures, which govern NSA, the FBI, the CIA, and 
NCTC respectively. The minimization procedures for NSA appear as Exhibit B to each 
certification, those for the FBI appear as Exhibit D, those for the CIA appear as Exhibit E, 



minimization procedures for each certification are identical; and 

(4) One set of querying procedures (“March 27, 2018, Querying Procedures”) for NSA, 


the FBI, the CIA, and NCTC, which appears as Exhibit H to each certification. 

The March 27, 2018, Submission also includes an explanatory memorandum prepared by the 
Department of Justice (“March 27,2018, Memorandum”). 

The Court was initially required to review and rule on the certifications and procedures 
within 30 days of their submission - ;'.e,, by April 26, 2018. See 6 702(j)(l)(B). In order to 
allow for participation of amici curiae, however, the Court extended this period by 90 days, until 
July 25, 2018, under Section 702(k)(2). See Order, April 5, 2018. The Court appointed Jonathan 
G. Cedarbaum, Esq., and Amy Jefffess, Esq., to serve as amici curiae. Order Appointing 
Amici Curiae, Apr. 23, 2018. At the request of Ms. Jeffress, the Court later appointed John 
Celia, Esq., as amicus curiae to assist in amici’s work. See Order Appointing Additional Amicus 
Curiae, May 7,2018. The Court appreciates the diligent and learned assistance provided by 
amici, both in their written submissions and in their oral advocacy at hearings. Their efforts have 
greatly benefited the Court’s review of these matters. 

Following briefing by amici and the government, the Court heard oral arguments by amici 
and representatives from the government on July 13, 2018. At the Court’s direction, staff orally 


Page 4 


DATE: Oct 8, 2019 - Authorized Public Release 


Page 4 of 138 


FISC Opinion. Oct. 2018 





Document regarding the Section 702 2018 Certification 


ODNI Authorized for Public Release 


informed the government three days later of the Court’s concerns regarding the procedures 
submitted by the government on March 27, 2018. 

In particular, the Court raised the following significant concerns with the Government: 

(1) eThe querying and minimization procedures included exemptions ffome 
otherwise applicable requirements for lawful training functions and lawfule 
oversight of an agency’s personnel or systems. Those exemptions seemede 
unreasonably broad under the standards of the Fourth Amendment and FISA’se 
definition of “minimization procedures.” See 50 U.S.C, §§ 1801(h), 1821(4);e 

(2) dUnder the querying procedures, the FBI would keep records of all queries rune 
against Section 702 data, but those records would not indicate whether the querye 
term used was associated with a United States person. This recordkeepinge 
practice appeared to be inconsistent with the statutory requirement that thee 
querying procedures “include a technical procedure whereby a record is kept ofe 
each United States person query term used for a query.” § 702(f)(1)(B); ande 

(3) eThe querying procedures did not require FBI personnel to document the basise 
for finding that each United States-person query term satisfied the relevante 
standard -i.e., that queries be reasonably designed to return foreign-intelligencee 
information or evidence of crime. Without such documentation and in view ofe 
reported instances of non-compliance with that standard, the procedures seemede 
unreasonable under FISA’s definition of “minimization procedures” and possiblye 
the Fourth Amendment. The Court noted it was favorably inclined toward amici’se 
suggestions that the Court require that, if FBI personnel want to examine thee 
contents of Section 702 information returned by a United States-person query,e 
they would first be required to document why that query met the applicablee 
standard.e 

On July 20, 2018, the government filed a motion seeking a further extension until 
October 1.8, 2018, in order for it to amend its procedures in an effort to address at least some of 
the Court’s concerns. See Mot, for Order Extending Time Limit Pursuant to 50 U.S.C. 
§d88la(k)(2). That motion stated, “In particular, the government believes it would be consistente 
with national security for the extension to provide sufficient time both for the government to 
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formulate and execute amendments and for the Court to review the amended 20 J 8 
Certifications.” Id at 9. On that same day, the Court granted the motion. 

The government timely filed its September 18, 2018, Submission, which includes 



Amendments” and to the certifications, as thereby amended, as “the 2018 Certifications.” The 


September 18, 2018, Amendments are accompanied by: 

(1) jj^^^^^Hsupporting affidavits of the Director of NS A, the Director of the FBI, thee 
Director of the CIA, and the acting Director of NCTC;e 

(2) Amended minimization procedures for the four agencies, which are identical for each 
amended certification. The amended minimization procedures for NSA appear as Exhibit 
B to each of the September 18, 2018, Amendments; those for the FBI appear as Exhibit 
D, those for the CIA appear as Exhibit E; and those for NCTC appear as Exhibit G; and 

(3) eA.mended querying procedures, which are identical for each amended certification ande 
are broken out by agency: NSA Querying Procedures, which appear as Exhibit H to thee 
September 18, 2018, Amendments; FBI Querying Procedures, which appear as Exhibit 1 ;e 
CIA Querying Procedures, which appear as Exhibit J; and NCTC Querying Procedures,e 
which appear as Exhibit K.e 

The September 18, 2018, Submission also includes an explanatory memorandum prepared by 
DOJ (“September 18, 2018, Memorandum”) and a supplemental declaration of the Director of 
the FBI (“Supplemental FBI Declaration”), 

The September 18, 2018, Submission included a number of changes intended to address 
the Court’s concerns. With regard to the concerns noted above, the government: 
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(1) significantly narrowed the scope of the exemptions for lawful traininga 
functions and lawful oversight of agency personnel or systems in the querying anda 
minimization procedures;a 

(2) afid not alter the FBFs recordkeeping requirements, but in the Supplemental 
FBI Declaration described the operational consequences the FBI anticipates if it isa 
required to maintain records that distinguish U.S.-person query terms from othera 
query terms and to document why U.S.-person queries met the applicable standarda 
before viewing any Section 702 content retrieved by the query; anda 

(3) aincluded in the FBI Querying Procedures supplemental procedures fora 
“categorical batch queries” (as opposed to queries conducted on the basis of a 
individualized assessments). Subject to certain exceptions, FBI personnel woulda 
be required to obtain the written approval of an FBI attorney before reviewinga 
Section 702 information retrieved using a categorical batch query.a 

The September 18, 2018, Submission was provided to amici, and on September 28, the 

Court heard oral arguments from amici and the government on the amended certifications and 

procedures. 


B. Subject Matter of the Certifications 

Each certification involves “the targeting of non-United States persons reasonably 
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The 20] 8 Certifications generally propose to continue acquisitions of foreign-intelligence 
information now being conducted under prior certifications that were initially submitted in 2016 
(“the 2016 Certifications”). See March 27,2018, Memorandum at 2. The 2016 Certifications, 



amended by the government in March 2017 and approved by the FISC on April 26, 2017. See 


Docket Nos 


^em. Op. and Order, Apr. 26, 2017 


(“April 26, 2017, Opinion”), at 5-6,95. The 2016 Certifications, in turn, generally renewed 
authorizations to acquire foreign-intelligence information under a series of certifications made by 
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The government also seeks approval of amendments to the certifications in the Prior 702 
Dockets, such that NSA, the CIA, the FBI, and NCTC henceforward would apply the same 
minimization and querying procedures to information obtained under prior certifications as they 



II. REVIEW OF THE 2018 CERTIFICATIONS AND PRIOR CERTIFICATIONS, 

AS AMENDED 


The Court must review a Section 702 certification “to detennine whether [it] contains alle 
the required elements.” § 702(j)(2)(A). The Court’s examination of the 2018 Certifications 
confirms that: 


(l)dhe certifications, including their amendments, have been made under oath bye 
the AG and the DNI, as required by § 702(h)(1)(A), see 



(2) the certificatio ns, including their amendments, contain the atte stations required 
by § 702(h)(2)(A),r 



(3)eas required by § 702(h)(2)(B), each certification is accompanied by targetinge 
procedures and minimization procedures adopted in accordance with § 702(d) ande 
(e), respectively^ 


(4) each certification is supported by affidavits of appropriate national-security officials,e 
as described in § 702(h)(2)(C); ande 


(5)esach certification includes an effective date, which was changed by the September 18, 
2018, Amendments as described in § 702(h)(3) - specifically, the certifications becomee 
effective on October 18, 2018, or the date upon which the Court issues an ordere 
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The 

described in § 702(h)(2)(E) is not required because there was no “exigent circumstances” 
determination under § 702(c)(2).) 

The Court therefore finds that the 2018 Certifications contain all the required statutory elements. 

Similarly, the Court has reviewed the certifications in the Prior 702 Dockets, as amended 
by the 2018 Certifications, and finds they also contain all the elements required by the statute. 



III. TARGETING PROCEDURES AND SCOPE OF ACQUISITION 


Section 702(d)(1) requires targeting procedures to be “reasonably designed” to “ensure 
that any acquisition authorized under [§ 702(a)] is limited to targeting persons reasonably 
believed to be located outside the United States” and to “prevent the intentional acquisition of 
any communication as to which the sender and ail intended recipients are known at the time of 
the acquisition to be located in the United States.” Additionally, the government uses the 
targeting procedures to ensure acquisitions do “not intentionally target a United States person 
reasonably believed to be located outside the United States.” § 702(b)(3). Pursuant to 
§e702(j)(2)(B), the Court assesses whether the targeting procedures satisfy those criteria. Thee 
Court must als« assess whether the targeting procedures, along with the querying and 
minimization procedures, are consistent with the requirements of the Fourth Amendment. See 
§e702(j)(3)(A)-(B).e 




statement 


In January 2018, Congress enacted the FISA Amendments Reauthorization Act of 2017 
(“Reauthorization Act”), Pub. L. No. 115-118, 132 Stat. 3 (2018). The Reauthorization Act 
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enacted Section 702(b)(5), which contains a limitation on the acquisition of “communications 
that contain a reference to, but are not to or from, a target of an acquisition authorized” under 
Section 702(a), which acquisition is colloquially referred to as “abouts” collection. 
Reauthorization Act § 103(a)(3). It specifically imposed, with narrow exceptions for exigent 
circumstances, a requirement of congressional notification and a 30-day congressional -review 
period before the government can resume abouts collection under Section 702. See id. 

§el03(b)(l )-(4). This Opinion refers to that requirement as the “abouts limitation.” In addition,e 
the government must “fully and currently inform” the Judiciary and Intelligence Committees of 
the House and Senate of “significant noncompliance . . . concerning any acquisition of abouts 
communications.” § 702(m)(4) (enacted by Reauthorization Act § 103(b)(5)). 

A. Background on Section 702 Acquisition 

The government targets a person under Section 702 by tasking for acquisition one or 
more selectors (e.g ., identifiers for email or other electronic-communication accounts) associated 
with that person. Section 702 encompasses different forms of acquisition. The government may 
acquire information “upstream,” as it transits the facilities of an Internet backbone carrier, as well 
as “downstream,” from systems operated by providers of service 
April 26, 2017, Opinion at 15. Traditional telephone communications may also be acquired 
upstream, but those acquisitions have not presented issues regarding scope of acquisition in the 
way that upstream Internet acquisitions have. In the following discussion, “upstream” collection 
refers to upstream acquisition of Internet communications under Section 702. 
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NSA is the only agency to conduct upstream collection under Section 702, while both the 
NS A and have roles in^^^^^^^|^^|downstream. the procedures, NSA is 

the lead agency in making targeting decisions under Section 702. The FBI Targeting Procedures 



Targeting Procedures §1.1 at 1. “Thus, the FBI Targeting Procedures apply in addition to the 

NSA Targeting Procedures,” Docket No 


em. Op., Sept. 4, 2008 (“September 4, 2008, Opinion”) at 20 (emphasis in original). 

It is worth highlighting two salient features of upstream collection as conducted prior to 
March 17, 2017, that bear on the issues raised by the abouts limitation: 

(1)«NSA sometimes acquired “multiple communication transactions,” or “MCTs,”e 
through upstream collection. An MCT is a bundle of communications transiting part of the 



(“Active user” refers to the user of a communication service to or from whom an MCT is in 
transit when it is acquired. See id. at 36.) 


(2)dn addition to information in transit to or from a tasked selector, NSA acquirede 
communications, including MCTs, about - i. e ., containing a reference to - a tasked selector. For 
example, if a single email message within an MCT contained a reference to a tasked email 
account, the entire MCT could be acquired, including numerous additional email messages that 
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did not contain a reference to a tasked selector. See id. For that reason, and because such MCTs 
could be acquired regardless of whether the active user was a Section 702 target, those additional 
email messages could be wholly unrelated to any target. See id. at 16-17. 

As a result, upstream collection as conducted prior to March 17, 2017, was “more likely 


than other fonns of Section 702 collection to contain information of or concerning United States 


persons with no foreign intelligence value.” Id. at 17 (internal quotation marks and citation 
omitted). Heightened restrictions were accordingly placed on NSA’s retention, use, and 
dissemination of information acquired through upstream collection, including a prohibition on 
queries that used U.S.-person identifiers as query terms. See id. at 17-18. 

Beginning in October 2016, while the 2016 Certifications were pending before the FISC, 
the government reported that NSA had violated that querying prohibition much more frequently 
than had been previously disclosed. The FISC discussed this issue at length in its opinion 
ultimately approving the 2016 Certifications, which were amended by the government to address 
that non-compliance. See id. at 14-30. Specifically, the government chose to stop acquiring 
abouts communications under Section 702 and memorialized that change in amended procedures 
for the 2016 Certifications. For example, the NSA Targeting Procedures were amended to state 
that “[acquisitions conducted under these procedures will be limited to communications to or 
from persons targeted in accordance with these procedures.” 2016 NSA Targeting Procedures, as 
Amended, Mar. 30, 2017, § 1 at 2 (emphasis added). Consistent with that provision, NSA limited 
acquisition of MCTs to situations where a Section 702 target was the active user or, put another 
way, a sender or recipient of the entirety of each MCT acquired. NSA’s current minimization 
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procedures (“2016 NSA Minimization Procedures”) were amended to state that Internet 
transactions acquired after March 17, 2017, “that are not to or from a person targeted in 
accordance with NSA’s section 702 targeting procedures are unauthorized acquisitions and 
therefore will be destroyed upon recognition,” 2016 NSA Minimization Procedures, as 
Amended Mar. 30, 2017, § 3(b)(4)b at 4. Relying on those changes, the Court approved the 
amended 2016 Certifications and procedures. See April 26, 2017, Opinion at 23-30, 95. 

The 2016 NSA Minimization Procedures (as amended in March 2017 and approved in 
April 2017) required the sequestration and destruction of all upstream Internet collection during 
the timeframe affected by the compliance incident, Aside from information retained subject to 
restricted access for litigation-hold purposes (see, e.g.. Gov’t Fifth Update Regarding Info. 
Acquired On or Before Mar. 17,2017, Pursuant to NSA’s Section 702 Upstream Internet 
Collection, July 18, 2018, at 5-8) NSA has completed the necessary destruction. 

The government is not seeking Court approval to resume what it regards as the 
acquisition of abouts communications under the 2018 Certifications and accompanying 
procedures. The Court nonetheless identified issues concerning the potential applicability of the 
abouts limitation to some information within the proposed scope of acquisition under the 2018 
Certifications and appointed amici to address the following: 

(a) eDo the preconditions on acquiring “abouts communications” imposed by Sectione 

103(b) of the [Reauthorization Act] apply only to fonns of acquisition that thee 
government discontinued under Section 702 in March 2017?e 

(b) elf the answer to (a) is “no,” do any fonns of acquisition to be conducted under thee 

2018 Certificatic 
consideration of 
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Order Appointing Amici Curiae, Apr. 23, 2018, at 4. The Court appreciates the helpful briefing 
it received from amici and the government on these issues. 

B. Analysis 

The Court’s examination will begin witl^^^^^^^^Hcollection. There is substantial 
agreement between the government and amici that such collection 
comports with the abouts limitation. 

The Court addresses escribed element (b)(i) above, 

examines that information as acquired upstream (in-transit) and then as acquired downstream 

Iwith respect to 

upstream collectioi^^^^^^^^^^^^Hthe Court concludes, again based on substantial 
agreement between amici and the government, that ^^^^^^^rollection will be conducted in a 
manner that complies with the limitation. 

The government and amici disagree as to whether the abouts limitation has any 
application to downstream collection. The Court, for reasons stated below, concludes that it does 
and addresses the application of the limitation to various types of downstream collection. The 
Court concludes that aeauisition I 

comports with the abouts 

comports with the abouts limitation becaus, 
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limitation. See, e.g„ Br. of Amici Curiae (“Amici Brief 5 ), May 31,2018, at 40 ( H [T]he 

Government otiers what to us are persuasive arguments that 

Bare limited to acquisitions of communications to or from targets and thus 
arc not subject to the restrictions in section 103 of the Reauthorization Act.”). ■ 


Amici conclude that the safeguards 


TW'lf 
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“ensure thai^^^^^^^^^^^^^^Kvill avoid intentional acquisition of abouts 
communications.” Amici Brief at 41-42; see also S 702(b)(5) (authorized acquisition may not 
intentionally acquire abouts communications). 

The Court is equally satisfied on the record before it that 

s reasonably designed to avoid the acquisition ofo 


abouts communications (or any other non-target communications) and to require the destruction 
of any non-target communications unintentionally obtained through such collection. 





communications to or from a Section 702 target, and to report on the methods it uses to audit 
information 

communications acquired are neither to nor from a Section 702 target, and the results of that 
auditing. See Amici Brief at 43. The Court adopts these recommendations, in part, as reflected 
in the reporting requirements set out at the end of this opinion. 
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Second, amici recommend that the Court require the government to brief Congress 



ordinary oversight processes are inadequate for this subject, and the Court sees no need to dictate 
the terms of executive-branch disclosures to Congress. The Court anticipates that congressional 
committees of jurisdiction will receive copies of this opinion. See 50 U.S.C. § 1 871(c)(1) 
(requiring Attorney General to submit to specified Congressional committees any decision, order, 
or opinion of this Court that includes a “significant construction or interpretation of any 
provision of law”). Congress will then have an informed opportunity to decide for itself what 



under Section 702. It will then examine the acquisition of such information through both 



abouts limitation potentially applies to both upstream and downstream collection, the 
may use both to 

abouts communications. 
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helpful in this regard. See Amici Brief at 30-33. 
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Amici contend, and the government does not contest, that such cases involve acquisition 
of “communications.” In support of that conclusion, amici point to the broad definition of 
“electronic communication” in the Electronic Communications Privacy Act (ECPA), 18 U.S.C. 

§ 2510(12) (1986), as ‘“any transfer of signs, signals, writing, images, sounds, data or 
intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, 

mnp n r r » rnr n i i ri w rm j nmn V Page 25 


DATE: Oct 8, 2019 - Authorized Public Release 


Page 25 of 138 


FISC Opinion, Oct. 2018 






Document regarding the Section 702 2018 Certification 


ODNI Authorized for Public Release 


photoelectronic or photooptical system that affects interstate or foreign commerce,’ subject to 



For purposes of the abouts limitation, it is important that all of the above-described 
communications would be in transit to or from a person who is accessing or using the account in 
question - i.e., the active user - at the time they could be acquired by upstream collection. So 
long as the active user is properly targeted under Section 702, the acquired communications 
would be to or from that target and therefore would fall outside the abouts limitation. And 
generally speaking, the active user of the account in question will be an authorized Section 702 
target if the account is properly tasked for acquisition under Section 702. That is because, with a 
exception for all users a for 

Section 702 are considered targets. See April 26, 2017, Opinion at 16 n.l 8; 2016 NSA 
Minimization Procedures, as Amended Mar. 30, 2017 § 4(c)(3) at 6 n.l (“any user of a tasked 
selector is regarded as a person targeted for acquisition”). (If a tasking of a facility is found to be 
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improper for some other reason - e.g., because one of its users is a U.S. person - further 
acquisition would be unauthorized, but not due to the about s limitation.) 

Hits procedures, as described above, now require it to limit 


acquisition to communications to or from a person targeted under Section 702. For example, 



(“Amici Reply”), June 29, 2018, at 4 (acknowledging that account information “acquired as a 

result of collecting communications to or from a targeted account I 

B would “plainly fall outside” the abouts 

limitation). 
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the abouts limitation. 


Amici make two recommendations with respect to upstream collection generally: (i) the 
government should be required to report on how it will comply with the abouts limitation when it 
tasks any new type of selector to upstream collection; and (ii) the Court should ensure that the 
government is systematically auditing compliance with the abouts limitation in such collection. 
See Amici Brief at 34-35. The Court agrees with amici’s first recommendation, and it is 
reflected in the reporting requirements included at the end of this opinion. As to the second, the 
government is directed to include information in any such report describing steps that will be 
taken to ensure that tasking the new type of selector will acquire only communications to or from 
a target. To the extent compliance problems arise in such collection, the government will apprise 
the Court in response to its compliance-reporting obligations, and the Court will have the 
opportunity to respond to the situation. 

c. Downstream Collection 
The government raises a threshold issue about whether the abouts limitation has any 
application to downstream collection at all. After answering that general question affirmatively, 
the then assesses whether the downstream acquisition falls 

the abouts limitation. 
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(i) A pplicability of Abouts Limitation to Downstream 
Collection 

Relying on legislative history, the government p*sits that Congress intended that 

limitation to apply only to reinstatement of upstream abouts collection, as previously conducted 

by NSA and discontinued in March 2017, and not to affect downstream collection. See Gov’t 

Response at 1-2. For example, a report of the Senate Select Committee on Intelligence (SSCI) 

described Section 1.#3 of the Reauthorization Act as “codifying] the Intelligence Community’s 

(IC’s) current prohibition on a subset of FISA collection under [Section 702] known as ‘Abouts’ 

Upstream collection." S. Rep. No. 115-182 at 1 (20)7). A report of the House Permanent Select 

Committee on Intelligence(HPSC1) stated: 

The Committee understands that the targeting procedures currently used by the 
NSA to conduct acquisitions pursuant to FISA Section 702 prohibit the 
acquisition of communications that are not "to” or “from” a FISA Section 702 
target. The new limitation established by Section [103] is intended to codify only 
current procedures and is not intended to affect acquisitions currently being 
conducted under FISA Section 702. 

H.R. Rep. No. 115-475, pt. 1, at 20 (2017) (emphasis added). Amici point out that the same 
general expectation was reflected in statements made by multiple members during floor debate 
on the Reauthorization Act. See Amici Brief at 22-23 & nn.24-25. 

The govermnent would have us take those statements to the bank. Amici largely concede 
the point of congressional intent, but argue that Congress might not have understood what • 

particular kinds of information are acquired under Section 702. See i(k at 28. They note that the 
legislative history of the Reauthorization Act does not discuss 

hey assert that silence with respect to a form of acquisition of which Congress 
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might not have been aware should not be taken to suggest that the abouts limitation does not 
apply. See id. at 17. The government, in response, points to, among other things, legislative 
history of the FISA Amendments Act of 2008 and litigation involving challenges to directives 


nee that Congress is fully on notice that the government acquires 



inder Section 702. See Gov’t Response at 2-4, 7, 


The Court is not well positioned to assess congressional understanding on this point. In 
any event, it must be mindful that “[t]he starting point in discerning congressional intent is the 
existing statutory text.” Laime v. U.S. Trustee, 540 U.S. 526. 534 (2004); accord, e.g. Sebelius 
v.eCloer, 133 S. Ct. 1886, 1893 (2013) (“As in any statutory construction case, ‘[w]e start, ofe 
course, with the statutory text....”’) (quoting BP America Production Co. v. Burton. 549 
U.S. 84, 91 (2006)). The plain meaning of that text must be given effect if “the disposition 
required by the text is not absurd.” Laime, 540 U.S. at 534. Here, the text of Section 702(b)(5) 
does not distinguish between upstream and downstream collection or otherwise refer to how 
acquisition is conducted. The provision merely describes communications that are not to or frome 
a target, but contain a reference to a target, and subjects the intentional acquisition of such 
communications to the notification and delay requirements of Section 103(b) of the 
Reauthorization Act. The Court discerns no absurdity in applying the abouts limitation, by its 
terms, to downstream collection and will advert to legislative history below only insofar as 
ambiguities are confronted in doing so. See Barnhill v. Johnson. 503 U.S. 393, 401 (1992)e 
(“appeals to statutory history are well taken only to resolve statutory ambiguity”) (internal 
quotation marks omitted); see also Mohamad v. Palestinian Authority. 132 S, Ct. 1702, 1709 
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(2012) (“[Rjeliance on legislative history is unnecessary in light of the statute’s unambiguous 
language.”) (internal quotation marks omitted); United States v. Gonzales. 520 U.S. 1, 6 (1997) 
(“Given the straightforward statutory command, there is no reason to resort to legislative 
history.”). 


(ii) A pplying Ahouts Limitation to Downstream Acquisition 



communications comports with the abouts limitation applies equally to ^. .. .ia 

effected downstream. The Court concludes that the downstream acquisition of such 
communications 

does not implicate the abouts limitation. 

amici and the government disagree as to whether the abouts limitation applies to this 
information. The government asserts that, consistent with longstanding practice, acquisitions 
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under Section 702 can and do include I ’J2 


and that this was understood bv Congress in passing the Reauthorization Act. See Gov’t 



worth noting constitute 

“communications” for purposes of the abouts limitation. The Court does not understand the 
government to assert that 
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he Court finds in 

any clearly communications for purposes *f the abouts 

limitation. For their acquisition to be authorized under the 2018 Certifications, such 
communications jnust be to or from a target. 

At the other end of the spectrum, it is conceivable that 



The statutory provisions describing the abouts limitation do not speak to this question, so the 
Court looks next to the broader statutory text and framework of Section 702. 

Upon a determination of exigent circumstances under Section 702(c)(2) or the issuance of 
a FISC order under Section 702(j)(3), “the [AG] and [DN1] may authorize jointly, for a period of 
up to 1 year from the effective date of the authorization, the targeting of persons reasonably 
believed to be located outside the United States to acquire foreign intelligence information.” 
§o702(a). FISA does not define “foreign intelligence information” in terms of the nature of theo 
information itself, but rather the national-security purposes it may serve: for example, the 
definition includes “information that relates to, and if concerning a United States person is 


Page 33 


DATE: Oct 8, 2019 - Authorized Public Release 


Page 33 of 138 


FISC Opinion, Oct 2018 



Document regarding the Section 702 2018 Certification 


ODNI Authorized for Public Release 



necessary to, the ability of the United States to protect against.., international terrorism,... the 
international proliferation of weapons of mass destruction, [and] ... clandestine intelligence 
activities” by foreign powers and their agents, as well as “information with respect to a foreign 
power or foreign territory that relates to, and if concerning a United States person is necessary to 


... the national defense or the security of the United States.” 50 U.S.C. § 1801 (e)(l)(B)-(C), 


(2)(A). 


Notwithstanding this broad charge to acquire “foreign intelligence information” in 
furtherance of national-security objectives, there are limitations on how acquisitions authorized 
under Section 702(a) may be conducted and against whom they may be directed. The abouts 
limitation is now one of them. It appears in Section 702(b) along with five other limitations on 
acquisitions authorized under Section 702(a). One of those other limitations, like the abouts 
limitation, applies to a certain type of communication and provides that an acquisition “may not 
intentionally acquire any communication as to which the sender and all intended recipients are 
known at the time of the acquisition to be located in the United States.” § 702(b)(4). The other 
limitations do not refer to communications. Three of them prohibit the intentional targeting of 
persons under certain circumstances - e.g., a U.S. person reasonably believed to be outside the 
United States or anyone known to be in the United States, § 702(b)(l)-(3) - while the remaining 
one states that acquisitions shall be conducted in a manner consistent with the Fourth 
Amendment. See § 702(b)(6). 

The statute also provides the means of accomplishing acquisitions authorized under 
Section 702(a): the AG and DN1 “may direct, in writing, an electronic communication service 


'TW 
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provider to . .. immediately provide the Government with all information, facilities, or assistance 
necessary to accomplish the acquisition in a manner that will protect the secrecy of the 
acquisition and produce a minimum of interference with the services” provided to the target of 
acquisition. See 6 702(i)(l)(A). Section 701 of FISA (codified at 5# U.S.C. § 1881) defines 
“electronic communication service provider” to include among other entities: 

(1) “a telecommunications carrier ” as that term is defined at 47 U.S.C. § 153.e 
See$ 701(b)(4)(A);e 

(2) d‘a provider of electronic communication service, as that term is defined at [18e 
U.S.C. §2510(15)].” § 701(b)(4)(B). Section 2510 defines “electronice 
communication service” as “any service which provides to users thereof thee 
ability to send or receive wire or electronic communications.” 18 U.S.C.e 

§e2510(15). It defines “electronic communication,” in turn, as “any transfer ofe 
signs, signals, writing, images, sounds, data, or intelligence of any naturee 
transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronice 
or photooptical system that affects interstate or foreign commerce,” but excludinge 
“any wire or oral communication” and certain other types of communications note 
pertinent here. Seg § 2510(12); ore 

(3) “any other communication service provider who has access to wire ore 
electronic communications either as such communications are transmitted or ase 
such communications are stored.” § 701 (b)(4)(D).e 


The government clearly may acquire communications under Section 702 subject to the 
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As the government suggests, see Gov’t Response at 6-7, that conclusion draws further 
support from language in Section 703 of FISA (codified at 50 U.S.C. § 1881b). Section 703, the 
original version of Section 702, and the definition of “electronic communication service 


provider” at Section 701(b)(4) were all enacted by the same provision of the FISA Amendments 
Act of 2008. See Pub. L. No. 110-261, § 101(a)(2), 122 Slat. 2436, 2437-53 (2008). Although 
Sections 702 and 703 differ in a number of ways - e.g., whether the targets are U.S. persons or 
non-U. S. persons - there are also similarities. Both sections involve “the targeting” of persons 
“reasonably believed to be located outside the United States to acquire foreign intelligence 


information,” §§ 702(a), 703(a)(1), and both provide for directing “an electronic communication 
service provider” to give the government “all information, facilities, or assistance necessary to 
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The government, in contrast, argues that Congress was probably silent on this point 
because it did not contemplate or intend that the abouts limitation would apply to downstream 
acquisitions at all. See Gov’t Response at 2. Amici concede that there is substantial support in 
the legislative history of the Reauthorization Act for that proposition. See, e.g.. Amici Brief 
at 28 (“[TJhere is considerable legislative history evidence to suggest that Congress understood 
the statutory restrictions it was putting in place as covering the same universe of communications 
that the Government had discontinued acquiring in March 2017, and even some evidence that 
some legislators understood that universe as related to upstream Internet communications.”). As 
noted above, the record evinces congressional concerns about a form of abouts collection that 
was upstream collection 

discontinued by NSA at the time the Reauthorization Act was passed. See, e.g., S. Rep. No. 
115-182, at 1 (noting that abouts limitation was intended to codify current prohibition of subseto 
of Section 702 collection known as “‘Abouts’ Upstream collection”). The accompanying House 
Report expressly disavowed any intention “to affect acquisitions currently being conducted under 
FISA Section 702.” See H.R. Rep. No. 115-475, pt. 1, at 20. There is little doubt that Congress 
had NSA’s intentional upstream collection of “abouts” communications and MCTs in its 


crosshairs in enacting the abouts limitatior 



The government also points to the legislative history of the FISA Amendments Act of 
2008 to the effect that its various provisions were meant to enable I 
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implementation, the government notes that congressional committees of jurisdiction have been 
specifically apprised of adversary proceedings brought by providers challenging directives. The 
government represents that those directives, and the judicial opinions addressing the provider 
challenges, have been produced to relevant committees and explicitly refer to 

See id. at 3 nn.1-3. 


To be abundantly clear, the Court does not rely on this history to support a conclusion 
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That conclusion does not leave the government at liberty to acquire I "" 

merely because it contains a reference to an account tasked for acquisition under 

only 

“contained in or pertains to” a tasked account. See FBI Targeting Procedures § 1.5 at 3. This 
accords with longstanding practice under Title 111 of FISA. &££ Gov’t Response at 4-5. 7 n.6. So 
understood, the FBI Targeting Procedures do much if not all of the work that could be done by 
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limited information contrasts with the scope of NSA’s pre-March 2017 upstream collection of 
abouts communications, including MCTs, which could acquire the contents ofa large number of 
ll.S.-person communications that were neither to nor from a target. See Pait II1.A above. In the 



Section 702 target outside the United States, or even the target herself, which would further 
reduce the likely intrusion on U.S. persons’ privacy. The Court is therefore satisfied 





is consistento 


with both the suirit and the letter of the abouts limitation. 
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“abouts” communication,) The Court views these examples as hypothetical and, so far as the 
Court is aware, counterfactual. In short, based on the current record, amici raise no serious 



concerns that any remotely likely to be conducted 

under the FBI Targeting Procedures would run afoul of the abouts limitation, even i f| 

That being said, the government notes that the above-described | 

| See, e.g. . March 27, 2018, Memorandum at 34-35. The Court 

understands that I 

FIBFCsTMAmici suggest that the government should be required to provide more information 
regard tij^^^^^^^^^^^^^^^^^^^^^^^btained 702. See, e.g.. 

Amici Brief at 37; Amici Reply at 2-3. The Court agrees with amici that a fuller accounting of 

Acquired pursuant to Section 702 will inform future 




assessments of whether particular acquisitions maybe subject to the abouts limitation and are 
otherwise properly authorized. The government has stated it would “endeavor to accommodate” 
a request for such an accounting. See July 13,2018, Proposed Tr. at 23. The Court consequently 
is ordering the government to provide additional information in this regard, as stated at the end of 
this opinion. 
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Otherwise, the changes to the government’s targeting procedures, see March 27, 2018, 
Memorandum at 37-43, present no impediment to the Court’s finding that the targeting 
procedures comport with the requirements of § 702(d)(1) and the Fourth Amendment. 

IV. THE QUERYING AND MINIMIZATION PROCEDURES 
A. Statutory Provisions 

Pursuant to § 702(j)(2)(C)-(D), the Court must assess whether the querying procedures 
and minimization procedures comply with specified statutory requirements. Those statutory 
requirements are summarized separately below. 

1. Requirements for Querying Procedures 
The Reauthorization Act required the government to adopt querying procedures and 
provided for FISC review of them. See Reauthorization Act § 101(a)(1)(B), (b)(1)(F), 132 
Stat. 3. The 2018 Certifications are the first ones subject to that requirement. Id^ § 101 (a)(2). 
Specifically, the AG, in consultation with the DN1, must “adopt querying procedures consistent 
with the requirements of the fourth amendment.. . for information collected” pursuant to a 
Section 702 certification, see § 702(f)(1)(A), and must “ensure” those procedures “include a 
technical procedure whereby a record is kept of each United States person query term used for a 
query.” § 702(f)(l )(B). “Query” is defined as “the use of one or more terms to retrieve the 
unminimized contents or noncontents located in electronic and data storage systems of 
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communications of or concerning United States persons obtained through acquisitions 
authorized” under a Section 702 certification. See § 702(f)(3)(B). The FISC must determine 
whether querying procedures satisfy the requirements of § 702(f)(1). See $ 702(j)(3)(A)-(B). 

The Reauthorization Act further amended Section 702 to require the government in 
specified circumstances to obtain a FISC order before accessing Section 702-acquired 
information. See Reauthorization Act § 101(a)(1)(B). Those amendments are codified at 
Section 702(f)(2). Specifically, that new statutory requirement applies: 

(1) mnly to the FBI, not the CIA, NSA or NCTC. See § 702(f)(2)(A);e 

(2) ©nly to accessing "the contents of communications .. . that were retrieved pursuant toe 
a query made using a United States person queiy term.” Id. For purposes of Sectione 
702(f); the term “contents,” “when used with respect to any wire, oral, or electronice 
communication, includes any information concerning the substance, puiport, or meaninge 
of that communication.” 18 U.S.C. § 2510(8) (incorporated by § 702(f)(3)(A)). The newe 
req uirement does not limit the authority of the FBI to conduct a lawful query, by whiche 
the contents of communications may be retrieved. See § 702(f)(2)(F)(i);e 

(3) ©nly with regard to “a query made using a United States person query tenn that wase 
not designed to find and extract foreign intelligence information.” § 702(f)(2)(A). Thee 
new requirement does not limit the FBI’s authority “to review, without a court order, thee 
results of any query .. . that was reasonably designed to find and extract foreigne 
intelligence information, regardless of whether such foreign intelligence informatione 
could also be considered evidence of a crime.” § 702(f)(2)(F)(ii); ande 

(4) eonly “in connection with a predicated criminal investigation opened by the [FBI] thate 
does not relate to the national security of the United States.” § 702(f)(2)(A). The newe 
requirement does not limit the FBI’s ability “to access the results of queries conductede 
when evaluating whether to open an assessment or predicated investigation relating to thee 
national security of the United States.” § 702(f)(2)(F)(iii).e 

In addition, the FBI need not obtain a Court order if it “determines there is a reasonable 
belief’ that the contents sought “could assist in mitigating or eliminating a threat to life or serious 
bodily harm.” § 702(f)(2)(E). 
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When the triggering conditions are satisfied, FBI personnel must apply for and receive a 
FISC order before accessing contents retrieved by such a query. See § 702(f)(2)(A). The 
application must be made upon oath or affirmation and approved by the AG based upon a finding 
that the application satisfies the statutory requirements. Sec $ 702(f)(2)(C). It must include “a 
statement, of the facts and circumstances relied upon . . . to justify the belief .. . that the contents” 
sought “would provide evidence of: (I) criminal activity; (11) contraband, fruits of a crime, or 
other items illegally possessed by a third party; or (III) property designed f*r use, intended for 
use, or used in committing a crime.” § 702(f)(2)(C)(ii). Upon such an application, “the Court 
shall enter an order approving the accessing of the contents of communications” if it “finds 
probable cause to believe that such contents would provide any of the evidence” described above. 
See § 702(f)(2XD). If such an order is not obtained when required, information concerning a 
U.S. person obtained through the pertinent query may not be used in a criminal proceeding 
against that person unless the AG determines the criminal proceeding relates to the national 
security or one of several specified serious crimes. See 50 U.S.C. § 188 le(a)(2)(A). 

2. Requirements for Minimization Procedures 

Section 702(e)(1) requires minimization procedures that “meet the definition of 

minimization procedures under [50 U.S.C. § 1801(h) or 1821(4)].” That definition requires 

(1 ^specific procedures . .. that are reasonably designed in light of the purpose ande 
technique of the particular surveillance (or physical search], to minimize thee 
acquisition and retention, and prohibit the dissemination, of nonpublicly availablee 
information concerning unconsenting United Stales persons consistent with thee 
need of the United States to obtain, produce, and disseminate foreign intelligencee 
information;e 
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(2) qirocedures that require that nonpublicly available information, which is note 
foreign intelligence information, as defined in [50 U.S.C. § 1801(e)(1)], shall note 
be disseminated in a manner that identifies any United States person, without suche 
person’s consent, unless such person’s identity is necessary to understand foreigne 
intelligence information or assess its importance; [and]e 

(3) eiotwithstanding paragraphs (1) and (2), procedures that allow for the retentione 
and dissemination of information that is evidence of a crime which has been, ise 
being, or is about to be committed and that is to be retained or disseminated fore 
law enforcement purposes[.]e 

§el 801(h). The definition of “minimization procedures” at § 1821(4) is substantively identical toe 
the definition at § 1803 (h) (although § 1821 (4)(A) refers to “the puiposes... of the particular 
physical search”). For simplicity, subsequent citations refer only to § 1801(h). 

Each agency having access to “raw,” or unminimized, information obtained under Section 
702 is governed by its own set of minimization procedures in handling that information. (This 
opinion uses the terms “raw” and “unminimized” interchangeably. The NCTC Minimization 
Procedures define “raw” information as “section 702-acquired information that (i) is in the same 
or substantially the same format as when NSA or FBI acquired it, or (ii) has been processed only 
as necessary to render it into a form in which it can be evaluated to determine whether it 
reasonably appears to be foreign intelligence information or to be necessary to understand foreign 
intelligence information or assess its importance.” NCTC Minimization Procedures § A.3.d 
at 2). 


The minimization procedures submitted in the Prior Dockets contained rules for querying 
raw Section 702 information. See, e.g., 2016 FBI Minimization Procedures § I1I.D at 11-12. In 
response to the enactment of § 702(f), the AG and DNI have adopted querying procedures for 
each agency that appear in a document separate from the relevant set of minimization procedures. 
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See page 6 above. Each agency’s procedures nonetheless make clear that the querying and 
minimization procedures are to be read and applied together. See, e.g.. NSA Querying 
Procedures § I at 1 (“These querying procedures should be read and applied in conjunction with 
[the separate] minimization procedures, and nothing in these procedures permits any actions that 
would otherwise be prohibited by those minimization procedures.”); FBI Querying Procedures 
§d at 1 (same); NSA Minimization Procedures § 1 at 1 (“These minimization procedures apply ine 
addition to separate querying procedures.. . . [They] should be read and applied in conjunction 
with those querying procedures, and nothing in these procedures permits any actions that would 
otherwise be prohibited by those querying procedures.”); FBI Minimization Procedures § I. A at 1 
(same). The Court therefore will assess whether each agency’s minimization procedures, in 
conjunction with the corresponding querying procedures, satisfy § 1801(h). 

B. Recordkeeping Requirement for U.S.-Person Query Terms 

The statute’s text plainly requires the relevant agencies, including the FBI, to keep 
records of U.S.-person query terms used to query Section 702 information. The FBI’s practice of 
keeping records of all queiy terms in a manner that does not differentiate U.S.-person terms from 
other tenns is inconsistent with that requirement. The Court begins with the statute and a textual 
analysis and then separately explains why the government’s arguments regarding text, legislative 
history, and policy considerations do not alter the outcome, 
l.e Background 

As noted above, the querying procedures must “include a technical procedure whereby a 
record is kept of each United States person query term used for a query.” § 702(f)(1)(B). The 
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querying procedures for each agency define “United States person query term” as “a term that is 
reasonably likely to identify one or more specific United States persons” which “may be either a 
single item of information or information that, when combined with other information, is 
reasonably likely to identify one or more specific United States persons.” CIA Querying 
Procedures § III. A at 1; NCTC Querying Procedures § III.A at 1; FBI Querying Procedures 
§eIIl.A at 1; NSA Querying Procedures § III. A at 1. Depending on context, “names or uniquee 
titles,” “government-associated personal or corporate identification numbers,” I ' 



id “street address, telephone, an 


;ould all constitute United States-person query terms. See CIA Querying 


Procedures § III.A at 2; NCTC Querying Procedures § III, A at 2; FBI Querying Procedures 
§eIll.A at 2; NSA Querying Procedures § III.A at 2.e 

Each agency’s querying procedures require the agency to “generate and maintain an 
electronic record of each United States person query term used for a query of unminimized 
information acquired pursuant to section 702.” CIA Querying Procedures § IV.B.l at 3; NCTC 
Querying Procedures § IV.B.l at 3; FBI Querying Procedures § IV.B.l at 4; NSA Querying 
Procedures § IV.B.l at 4. If, however, “it is impracticable” for a particular system “to generate 
an electronic record,” or if “an unanticipated circumstance ... prevents the generation” of an 
electronic record, the agency “must generate and maintain a written record of each United States 
person query term that contains the same information required for electronic records.” CIA 
Querying Procedures § IV.B.3 at 4; NCTC Querying Procedures § IV.B.3 at 4; FBI Querying 
Procedures § IV.B.2 at 4; NSA Querying Procedures § IV,B.2 at 4. Agencies may run queries on 
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systems that do not generate electronic records only when necessary for “technical, analytical, 
operational, or security reasons.” CIA Querying Procedures § IV.B.3 at 4; NCTC Querying 
Procedures § IV.B.3 at 4; FBI Querying Procedures § IV.B.2 at 4; NSA Querying Procedures 
§dV.B.2 at 4. The agencies must maintain their electronic and written records for at least fivee 
years from the date of the query (or in the case of NSA for at least five years from the date of 
approval to use a United States-person query term to query content information). See CIA 
Querying Procedures § IV.B.4 at 4; NCTC Querying Procedures § IV.B.4 at 4; FBI Querying 
Procedures § IV.B.3 at 4-5; NSA Querying Procedures § IV.B.3 at 4. 

For the CIA, NCTC, and the FBI, the electronic record must include “the query term(s) 
used,” “the date of the query,” and “the identifier of the user who conducted the query.” CIA 
Querying Procedures § IV.B.l at 3; NCTC Queiying Procedures § IV.B.l at 3; FBI Querying 
Procedures § IV.B.l at 4. NSA’s use of United States-person query terms “to identify and select 
unminimized section 702-acquired content” information requires prior approval by its Office of 
General Counsel. See NSA Querying Procedures § IV.A at 3. The duration of such approvals 
may not exceed one year, but may be extended in increments of one year. Id. The electronic 
record for NSA’s use of a United States-person query term accordingly must include “the query 
term(s) used or approved”; “the date of the query or approval of the query terms(s)”; “the 
identifier of the user who conducted the query or sought approval of the query term(s)”; and “in 
the case of content queries, the approving official in NSA’s Office of General Counsel and 
duration of the approval.” § IV.B.l at 4. 
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Unlike the other agencies, the FBI “intends to satisfy the record-keeping requirement by 


keeping a record of all queries” of un-minimized Section 702 information. See FBI Querying 


Procedures § 1V.B.3 at 4 n.4 (emphasis added). The resulting FBI records, in other words, will 
not distinguish between United States-person query terms and other query tenns. See March 27, 
2018, Memorandum at 27. In fact, the government represents that the FBI already keeps records 
of all Section 702 query tenns without distinguishing between U.S.-person query tenns and non- 
U.S.-person query tenns and contends that Section 702(f)(1)(B) requires no change. See id. 
at 26. 


2. Application of Section 702(f)(l!fB) to FBI Recordkeeping Practices 


Tire issue presented by the FBI’s current recordkeeping is straightforward: Is the 
requirement for “a technical procedure whereby a record is kept of each United States person 
query tenn used for a query” satisfied by a procedure that results in records that do not indicate 
whether tenns are United States-person query tenns? The plain meaning of the statutory text 
suggests that the answer is “no.” 


Textual Analysis 


a. 


A “record” serves to memorialize information. See, e.g.. Black’s Law Dictionary (10th 
ed. 2014) (defining “record” as, among other tilings, “1, A documentary account of past events, 
usu. designed to memorialize those events”); Webster’s II New College Dictionary 927 (2001) 
(defining “record” as “1. a. An account, as of infonnation, set down esp. in writing as a way of 
preserving knowledge, b. Something on which such an account is made. .. 2. Infonnation or 
data on a specific subject collected and preserved”). Section 702(f)(l )(B) identifies “each United 
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States person query term used for a query” as the information that must be memorialized. 

The government argues that records that document all terms used to query Section 702 
information, regardless of whether the term is a United States-person query term or not, satisfies 
Section 702(f)(1)(B) because that provision “does not include any other term, such as 
‘separately 5 or ‘segregated,’ specifying that United States person query terms must be retained 
apart from other queries.” March 27, 2018, Memorandum at 27; see also Gov’t Response 
at 28-29 (statute “does not include any additional language specifying that U.S. person query 
terms must be retained separate and apart from other queries”). The government’s argument, 
however, misses the essential aim of the recordkeeping requirement, which is to memorialize 
when a United States-person query term is used to query Section 702 information. Just as 
records of all applicants admitted to a university are not records of out-of-state applicants 
admitted if they do not differentiate out-of-state from in-state, records that do not memorialize 
whether a query term used to query Section 702 data meets the definition of a United States- 
person query term do not preserve the information specifically required by Section 702(f)(1)(B). 

Section 702(f)(1)(B), moreover, imposes a recordkeeping requirement only for queries 
that use United States-person query terms, not for all queries. It is not reasonable to expect 
Congress to have focused on the circumstance of an agency’s generating records for all its 
Section 702 query terms and to have explicitly reiterated that, in such a case, the records must 
document which of those query terms are United States-person query terms. The language 
Congress chose to enact clearly conveys that the records are meant to memorialize when United 
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States-person query terms are used, and the FBI is obligated to keep records that do so, regardless 
of whether it also keeps records for other query terms. 

The government also argues that, in light of an exemption from certain aspects of public 
reporting required by Section 603 of FISA (codified at 50 U.S.C. § 1873), Section 702(f)(1)(B) 
should not be read as requiring the FBI to alter its current recordkeeping practices. Section 603 
requires the DNI to report publicly on, among other things, “the number of search terms 
concerning a known United States person used to retrieve the unminimized contents of electronic 
communications or wire communications obtained” under Section 702 and “the number of 
queries concerning a known United States person of unminimized noncontents information 
relating to electronic communications or wire comm unications obtained” under Section 702, 
§e603(b)(2)(B)-(C); however, “information or records held by, or queries conducted by,” the FBIe 
are explicitly exempted from that reporting, except insofar they relate to FISC orders issued 
under Section 702(f)(2). See § 603(d)(2)(A). The government attributes this exemption of FBI 
queries to congressional recognition that the FBI lacked the capacity to provide the relevant 
information. See March 27,2018, Memorandum at 29 (quoting H.R. Rep. No. 114-109, pt. 1, 
at 26 (2015) (“the FBI is exempted from reporting requirements that the agency has indicated it 
lacks the capacity to provide”)). 

The government suggests that because Congress generally exempted FBI queries from the 
DNFs annual reporting (only requiring reporting for FBI queries that relate to Section 702(f)(2) 
orders), the recordkeeping requirement of Section 702(f)(1)(B) should be read to make similar 
allowances for the FBI’s limited capabilities. See March 27, 2018, Memorandum at 30 
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(Congress “presumably would have included such queries in the statistics required to be reported 


in the annual DNI report” if it had “intended for FBI to distinguish and separately track United 


States person queries.”). The premise of the government’s argument is that the only purpose for 
keeping records that identify United States-person query terms is to satisfy the DNI’s reporting 
obligations. That premise is belied by the government’s own briefing, which acknowledges 
oversight of the agencies’ querying practices as another purpose of Section 702(f)(l )(B)’s 
recordkeeping requirement. See March 27, 2018, Memorandum at 27. Because the 
recordkeeping requirement serves a purpose separate from the reporting obligations, there is no 
inconsistency between exempting from public reporting the number of U.S.-person queries 
conducted by the FBI and requiring the FBI to keep records that identify which Section 702 query 
terms are United States-person query terms. The explicit exemption set forth in Section 
603(d)(2)(A) demonstrates, moreover, that if Congress intended for Section 702(f)(1)(B) to make 
similar allowances for the FBI, it would have been easy to provide for them expressly. 

In support of its position, the government also cites Section 112 of the Reauthorization 
Act, which requires the Inspector General of DOJ to report to Congress on the FBI’s 
implementation of querying procedures within one year of their approval by the FISC. See 
March 27, 2018, Memorandum at 31. In addition to requiring the Inspector General to assess 
several aspects of FBI’s implementation of the querying procedures, Section 112 requires the 
Inspector General to assess any 

impediments, including operational, technical, or policy impediments, for the 
[FBI] tv count - 

(A)ethe total number of queries where the FBI subsequently accessed informatione 
acquired under.. . section 702;e 
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(B )&he total number of such queries that used biown United Slates person 
identifiers ; ande 

(C) the total number of queries for which the [FBI] received an order of thee 
Foreign Intelligence Surveillance Court pursuant to [Section 702(f)(2)].e 

§ 112(b)(8) (emphasis added). The government argues that Congress recognized “the limitationse 

of FBI systems’ technical record-keeping function” when it enacted Section 112, and that this 

provision makes clear it “did not intend to impose any new obligation on the FBI to differentiate 

queries based on United States person status.” March 27, 2018, Memorandum at 31: see also 

Gov’t Response at 30 (“If, as amici claim, the Reauthorization Act newly mandates that FBI 

separately track U.S. person query terms, a new statutory directive requiring an IG report 

discussing ‘impediments, including operational, technical or policy impediments’ to do that very 

thing would be pointless.”). The government’s argument ignores that Section 112(b)(8)(C) of the 

Reauthorization Act directs the Inspector General to report on impediments to the FBI’s counting 

of U.S.-person queries f*r which it receives a FISC order under Section 702(f)(2) - information 

the DNI is explicitly required to report under Section 603 of FISA, as amended by the 

Reauthorization Act. See FISA § 6t3(b)(2)(B) & (d)(2)(A), as amended by Reauthorization Act 

§el02(b)(2)(B)(ii).e 

Amici contend that Congress did not acquiesce in cuirent FBI practices, but rather 
imposed new recordkeeping requirements and deputized the Inspector General to scrutinize how 
the FBI implements them. See Amici Brief at 80-81. Amici have the better of the exchange. 
Congress can sensibly be understood to have directed the Inspector General to assess 
impediments toward the FBI’s counting queries that employ U.S.-person identifiers as query 
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terms (Reauthorization Act § 112(b)(8)(B)), while simultaneously requiring the FBI and other 
agencies to maintain records necessary to perform that count. 


b. Legislative History 


The government further argues that the legislative history of the Reauthorization Act 

supports its conclusion that the FBI’s recordkeeping is consistent with Section 702(f)(1)(B). 

Even if one assumes arguendo that the statute is reasonably susceptible to the government’s 

interpretation, such that ambiguity justifies recourse to legislative history, see Part Ill.B.2.c(i) 

above, the government’s arguments are unavailing. 

The government points to the following statement in a HPSCI report: 

[Section 702(f)(l )(B)] does not impose a requirement that an Intelligence 
Community element maintain records of United States person quejy terms in any 
particular maimer, so long as appropriate records are retained and thus available 
for subsequent oversight. This section ensures that the manner in which [an 
agency] retains records of United Slates person query terms is within the 
discretion of the Attorney General, in consultation with the Director of National 
Intelligence and subject to the approval of the FISC. 

H.eRep. No. 115-475, pt. 1, at 18 (emphasis added) (quoted in March 27, 2018, Memorandum ate 

27). The government suggests that the FBI’s recordkeeping practices reflect a permissible 

exercise of the discretion of the AG and the DNI “to determine how an agency would keep 

records of queries in a manner that allows for meaningful oversight.” March 27,2018, 

Memorandum at 27 (emphasis added). But the issue presented is whether the FBI’s records will 

memorialize the information required by the statute. The passage from the HPSCI report clearly 

indicates that, however records are kept, they must be “records of United States query terms.” It 

provides no reason to think that (1) HPSCI understood “records of United States person query 
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terms” to include records that do not indicate whether query terms are United States-person query 
terms, or (2) HPSC1 intended to leave that determination to executive-branch discretion. In 
addition, the first sentence of the paragraph from which the above quotation is taken describes 
the required records in language that closely tracks the statutory text: “Section 201 [of the 
Reauthorization Act] further mandates that all querying procedures include a provision requiring 
that a record is kept for each United Slates person query term used for * query of FISA Section 
702 data.” H. Rep. No. 115-475, pt. 1, at 18 (emphasis added). HPSCI’s reiteration of the “U.S. 
person” nature of query terms that must be recorded makes clear that the discretionary manner in 
which an agency keeps the required records does not include the freedom to decide not to record 
the fact that a query term is a United States-person query term. 

The report’s reference to “subsequent oversight,” moreover, is consistent with an intent 
that the records document use of United States-person query terms, as such, particularly in view 
of HPSCI’s acknowledgment “that certain lawmakers and privacy advocates worry about the 
ability of the Intelligence Community to query lawfully acquired data using query terms 
belonging to United States persons.” Id. at 17, Such oversight would be best served if the 
records indicate whether a particular query tenn is a United States-person query term - i.e., a 
tenn reasonably likely to identify' one or more specific U.S. persons. 

The government also relies on a statement in the same report that “the Committee 
believes that the Intelligence Community should have separate procedures documenting their 
current policies and practices related to the querying of lawfully acquired FISA Section 702 
data.” Id. at 17-18 (emphasis added) (quoted in March 27, 2018, Memorandum at 28). The 
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government argues that, because “Congress understood the FBI’s existing practice . .. and the 
limitations of FBI systems’ technical record-keeping,” the reference to query procedures that 
document current policies and practices demonstrates HPSCl’s intent that the FBI need not alter 
its recordkeeping in response to Section 702(f)(1)(B). See March27, 2018, Memorandum 
at 26, 28. But the report’s generic reference to current policies and practices of the Intelligence 
Community appears in a discussion of the general requirement to adopt querying procedures, not 
the specific recordkeeping requirements of Section 702(f)(1)(B). The report, furthermore, does 
not mention any technical limitations of FBI systems or describe, let alone endorse, the FBI- 
specific practice of keeping records that do not identify which query terms are United States- 
person query terms. Neither the plain language of the statute nor the plain language of the report 
cited by the government supports its contention that Congress intended no changes to FBI’s 
existing querying practices in response to the Reauthorization Act. 
c. Policy Considerations 

Finally, the government contends that requiring the FBI to maintain records that 
differentiate United States-person query terms from other Section 702 query terms will have 
adverse consequences. See Supplemental FBI Declaration at 8-15. In his declaration, the 
Director of the FBI does not describe as a source of difficulty any “limitations of FBI systems’ 
technical record-keeping functions.” March 27, 2018, Memorandum at 26, 28. Instead, he posits 
that such a requirement would leave the FBI with two possible means of implementation, neither 
of which is desirable. Under one option, FBI personnel would conduct research in FBI holdings 
to inform their assessments of which proposed query terms are United States-person query terras 
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tor purposes of Section 702(f)(1)(B). See Supplemental FBI Declaration at 8-9. The Director 

anticipates that approach would divert resources from investigative work, delay assessment of 
threat information, and discourage its personnel from querying unminimized FISA information, 
to the detriment of public safety. Id. at 9-12. He also describes an alternative approach whereby 
personnel would be allowed fo forgo such research and rely solely on their “personal knowledge” 
in making those assessments. Id. at 12. The Director expects that practice would “result in 
inconsistent and unreliable information in FBI systems,” id* thereby complicating other aspects 
of the FBI’s work - e.g. y implementing its Section 702 targeting procedures. Id, at 13-14. The 
Director also expresses concern that such an approach would be inconsistent with the FBI’s 
“strong culture that places great emphasis on personnel consistently conveying true and accurate 
information.” Id. at 14. 

All of those points raise policy considerations regarding the advisability of requiring the 
FBI to keep records that identify United States-person query terms it has used to query Section 
702 information. The Court, it should be emphasized, makes no determination as to the 
advisability of a particular policy on this subject. Regardless of how persuasive the FBI’s 
considerations may be, the Court is not free to substitute its understanding of sound policy - or, 
for that matter, the understanding of the Director of the FBI - for the clear command of the 
statute. See 14 Penn Plaza LLC v. Pvett, 556 U.S. 247, 270 (2009) (“Absent a constitutional 
barrier, ‘it is not for us to substitute our view of... policy for the legislation which has been 
passed by Congress.’”) (quoting Florida Dept, of Revenue v. Picadillv Cafeterias. Inc.. 554 
U.S. 33, 52 (2008)); Barnhart v. Sigmon Coal Co, 534 U.S. 438,462 (2002) (“We will not alter 
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the [statutory] text in order to satisfy the policy preferences of the Commissioner [of Social 
Security].”); Herb’s Welding, Inc, v. Gray, 470 U.S. 414,427 (1985) (“[I]f Congress’... 
decisions are mistaken as a matter of policy, it is for Congress to change them. We should not 
legislate for them.”). In sum, the Court is it is merely enforcing what Section 702(f)(1)(B) 
plainly imposes. 

d. Conclusion 

In short, the Court should follow the '“first canon”’ of statutory construction: to presume 
that Congress says in a statute what it means and means in a statute what it says. Barnhart, 534 
U.S. at 461-62 (quoting Connecticut Nat’i Bank v. Germain, 503 U.S. 249, 253-54 (1992)). 
Section 7#2(f)(l )(B) plainly states that the querying procedures must include “a technical 
procedure whereby a record is kept of each United States person query tenn used for a query.” 
That requirement is not satisfied by procedures under which the FBI does not keep such records 
in a readily identifiable manner. The Court accordingly finds that the FBI Querying Procedures 
do not comport with Section 702(f)(1)(B). 

The Supplemental FBI Declaration touches on another point that the Court will address 
because it may bear on curing this deficiency. Section III.B of the FBI Querying Procedures 
provides for certain presumptions regarding U.S.-person status. FBI Querying Procedures § III.B 
at 3. The Declaration, however, discounts their potential utility in alleviating the problems 
anticipated by the FBI because “they would generally require FBI personnel to evaluate 
information in FBI holdings before applying a presumption.” Supplemental FBI Declaration 
at 13 n.7. But the government can revise those procedures to address specifically what, if any, 
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steps its personnel need to take before relying on presumptions in deciding what terms to treat as 
United States-person query terms for purposes of Section 702(f)(1)(B). Such revised procedures, 
of course, would be subject to FISC review pursuant to Section 702(j). In any event, there are 
clearly some queries for which FBI personnel know they are using United States-person query 
terms, and the obligation to keep adequate records of those terms pursuant to Section 
702(f)(1)(B) will be readily apparent. 

Finally, the Court does not hold that the FBI must immediately deploy a comprehensive 
technical means of generating appropriate records. So long as it is taking serious steps toward 
implementing such technical means, it may rely on “written” records, as described at FBI 
Querying Procedures § IV.B.2 at 4. 

C. FBI Querying Practices and Statutory and Constitutional Requirements 

The Court next independently finds that the FBI’s repeated non-compliant queries of 
Section 702 information preclude (1) a determination that its minimization and querying 
procedures are reasonably designed to minimize the retention, and prohibit the dissemination, of 
private information concerning U.S. persons, consistent with the government’s foreign- 
intelligence needs, and (2) a finding that such procedures are consistent with the requirements of 
the Fourth Amendment. 

This section begins by describing the role of querying rules within minimization 
procedures and discussing the reasonableness of the FBI ’s querying standard, as written. The 
Court then reviews numerous instances of non-compliance with that standard and three factors 
that contribute to the Court’s concerns about the FBI’s querying practices. The Court then 
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considers steps the government has taken to respond to non-compliant queries, including 
requiring FBI personnel to obtain attorney approval before examining content information 
returned by certain categorically justified queries, and concludes they are insufficient to support 
the required findings. Finally, the Court examines amici’s proposal regarding FBI 
documentation of query justifications, adoption of which the Court believes would remedy the 
deficiency. 


1. Querying and Effective Minimization 

The Foreign Intelligence Surveillance Court of Review (FISCR) has instructed: 

By minimizing retention,. Congress intended that ‘'information acquired, which is 
not necessary for obtaining[,] producing, or disseminating foreign intelligence 
information, be destroyed where feasible.” Furthermore, £ ‘[e]ven with respect to 
information needed for an approved purpose, dissemination should be restricted to 
those officials with a need for such information.” 

hi Re Sealed Case. 310 F.3d 717, 731 (FISCR 2002) (per curiam) (quoting H.R. Rep. No. 95- 

1283, pt. 1 at 56 (1978) and adding emphasis; internal citations omitted). 

Notwithstanding that preference for destruction of non-pertinent information when 

feasible, the FISC has approved minimization procedures that permit retention for considerable 

periods of time, even after information has been reviewed and not found to relate to foreign 

intelligence or evidence of crime. See, e.tz,. 2016 FBI Minimization Procedures § Ill.G.l .b at 23 

(such information may be retained for up to 15 years, with enhanced access controls in place after 

ten years). The FBI minimization procedures now before the Court propose the same approach. 

See September 18, 2018, FBI Minimization Procedures § 1I1.D.4.C at 17 (same). The 

reasonableness of such a retention period rests in part on the “complex and time-intensive nature 
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of piecing together, and making sense of, the myriad pieces of information gathered during a 
lengthy surveillance.” United States v. Mubayyid, 521 F. Supp. 2d 125, 134 (D. Mass. 2007) 
(finding retention of FISA intercepts for ten years reasonable in circumstances of case). But it 
also importantly depends on querying rules and other access restrictions that guard against the 

Dp.and 

Order, May 17, 2016 (“May 17, 2016, Opinion”) at 25 (“because raw FISA-acquired information 

be accessible by large numbers of persons in the FBI 
for a wide variety of investigative and analytical purposes, it is especially important for U.S. 
person information on those systems to be subject to appropriate access restrictions,” including 
querying rules); idL at 43 (“substantive standards for querying data” “guard against indiscriminate 
or improper accessing or use of U.S. person information”); 

em. Op. and Order, Nov. 6, 2015 (“November 6, 2015, Opinion”) 
at 24 (relying on “several important restrictions” of CIA and NSA minimization procedures for 
§a702, “[m]ost notably” that all terms used to query the contents of communications must bea 
“reasonably likely to return foreign intelligence information”) (internal quotation marks omitted). 

The government notes that agency personnel do not need to run queries to find and 
examine Section 702 information concerning United States persons. They can, for example, 
review Section 702 data on a communication-by-communication basis and thereby encounter 
U.S.-person information. See Gov’t Response at 14-15. Despite the availability of that 
alternative, the rules for U.S.-person queries - i.e ., queries that use a “United States person query 
term” as defined at FBI Querying Procedures § III. A - are important to proper minimization of 





indiscriminate review and use of U.S.-person information. See 
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Section 702 information. The government’s own submissions emphasize the operational 
importance of the FBI being able to query information and the large number of queries of FISA 
information conducted by the FBI. See, e.g.. Supplemental FBI Declaration at 6 (“[database 
queries are a critical tool,” and in one system during fiscal year 2017, FBI ran approximately 3.1 
million queries “against raw FISA-acquired information ..., including section 702-acquired 
information”). Given the importance and prevalence of querying, it is a logical focus for efforts 
to balance protection of U.S. persons’ privacy interests against foreign-intelligence needs. The 
enactment of Section 702(f) indicates Congress drew a similar conclusion. 

Indeed, the rules for U.S.-person queries are especially important for minimization of 
Section 702 information. Section 702 provides a means for the government to target individuals 
who are reasonably believed to be non-U.S. persons located outside the United States. See 
§e702(b)(l), (3) (prohibiting intentional targeting of U.S. persons and any persons located insidee 
United States); (d)(1)(A) (requiring targeting procedures reasonably designed to ensure only 
persons reasonably believed to be located outside United States are targeted). The government 
may acquire the full contents of communications under Section 702 without a finding of probable 
cause, as is needed for electronic surveillance and physical search under FISA. See 50 U.S.C. 

§§ 1805(a)(2), 1824(a)(2). When the government queries Section 702 data to identify ande 
examine information about a particular U.S. person, moreover, it typically has an investigative or 
analytical interest regarding that person, who necessarily was not a target of the acquisition. As 
suggested by amici, it can also result in a further intrusion into the privacy of such U.S. persons, 
who may have enjoyed “the protection of anonymity” until information concerning them was 
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retrieved by use of an individualized U.S.-person query directed at them. See Amici Reply at 9. 
And FBI queries intended to retrieve evidence of crime may be conducted in the course of law- 
enforcement investigations that are unrelated to national-security threats. 

The FBI’s querying practices under Section 702 are especially important because the FBI 
conducts many more U.S.-person queries than the other agencies. In 2017, NCTC, the CIA, and 
NSA collectively used approximately 7500 terms associated with U.S. persons to query content 
information acquired under Section 702, see Amici Brief at 51 n.47; Gov’t Response at 32, while 
during the same year FBI personnel on a single system ran approximately 3.1 million queries 
against raw FISA-acquired information, including section 702-acquired information. See 
Supplemental FBI Declaration at 6. (As explained above in Part IV.B.l, FBI records do not 
differentiate between U.S,-person query terms and other query terms, but given the FBI’s 
domestic focus it seems likely that a significant percentage of its queries involve U.S.-person 
query terms.) The large number of U.S.-person queries run by the FBI makes its querying 
practices significant, despite its receiving only a small percentage of the total information 
acquired under Section 7t2. See Gov’t Response at 26-27 (it was reported in October 2017 that 
FBI received information for approximately 4.3% of persons targeted under Section 702). 

2. The FBI’s Querying Standard 
The FBI Querying Procedures require: “Each query of FBI systems containing 
unminimized content or noncontent information acquired pursuant to section 702 of [FISA] must 
be reasonably likely 1o retrieve, foreign intelligence information , as defined by FISA, or evidence 
of a crime, unless otherwise specifically excepted in these procedures.” FBI Querying 
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Procedures § IV.A. 1 at 3 (emphasis added). (Certain of those exceptions are discussed below in 
Part IV.D.) As written and in the context of restrictions on the use and disclosure of U.S.-person 
information within the FBI Minimization Procedures, that querying standard is consistent with 
the statutory definition of minimization procedures; however, as implemented by the FBI, it is 
not. 


Tire minimization procedures now in effect articulate the standard for FBI queries of 
Section 702 information differently: “To the extent reasonably feasible,” FBI personnel “must 
design” queries of unminimized Section 702 information “to find and extract foreign intelligence 
information or evidence of a crime.” 2016 FBI Minimization Procedures § III.D at 11. The 
government represents that “[i]n practice, the applicable standard remains the same ... March 
27, 2018, Memorandum at 24. Counsel for the government has characterized the FBI querying 
standard as a high one, having three elements: (1) a query cannot be “overly broad,” but rather 
must be designed to extract foreign-intelligence information or evidence of crime; (2) it must 
“have an authorized purpose” and not be run for personal or improper reasons; and (3) there must 
be “a reasonable basis to expect [it] will return foreign intelligence information or evidence of 
crime.” July 13, 2018, Proposed Tr. at 9; see also March 27, 2018, Memorandum at 25 (there 
must be “a reasonable basis to believe the ijuery is likely to return foreign intelligence 
information or, in the case of the FBI only, evidence of a crime.”). 

The FBI querying standard - as written and as explicated in the manner summarized 
above - presents no impediment to finding that the FBI Querying Procedures and FBI 
Minimization Procedures satisfy the definition at § 1801 (h). Queries that are reasonably likely to 
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return foreign-intelligence information, are conducted for that purpose, and avoid overbreadth 
should contribute to the minimization of private U.S.-person information, consistent with 
foreign-intelligence needs, as contemplated by § 1801 (h)(1). (The same conclusion holds for the 
querying standards applied by the other agencies, which require queries to “be reasonably likely 
to retrieve foreign intelligence information,” unless specifically excepted. SeeNCTC Querying 
Procedures § IV.A at 3; CIA Querying Procedures § 1V.A at 3; NSA Querying Procedures § IV.A 
at 3.) FBI queries that are reasonably likely to return evidence of crime comport with § 1801(h) 
for reasons explained at pages 30-34 of the November 6,2015, Opinion and adopted herein. 

3.e Non-Compliance with the Querying Standard 
FISC review of minimization procedures under Section 702 is not confined to the 
procedures as written; rather, the Court also examines how the procedures have been and will be 



implemented. See, e.g. . Docket 
Nos. 


em. Op., Apr. 7, 2009, at 22-24; Docket 
em. Op., Aug. 30, 2013, at 6-11. In this 


case, the government contends that the FBI’s implementation of the querying standard has 
provided appropriate protection for U.S. persons’ privacy. See Gov’t Response at 32-33. For 
reasons explained below, the Court does not agree. 

Since April 2017, the government has reported a large number of FBI queries that were 
not reasonably likely to return foreign-intelligence information or evidence of crime. In a 
number of cases, a single improper decision or assessment resulted in the use of query terms 
corresponding to a large number of individuals, including U.S. persons. In brief: 

unducted queries 

using identifiers for over 70,000 communication facilities “associated with” 


• During March 24-27, 2017, the FBI’.J 
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?ersons with access to FBI facilities and systems. See Nov. 22, 2017, Notice at 2. 

proceeded with those queries notwithstanding advice 
rom tne pm uttice ot General Counsel (OGC) that they should not be conducted 
without approval by OGC and the National Security Division (NSD) of the 
Department of Justice. Id at 3. The FBI did not examine the results of those 
queries. Id. [Most of the notices of non-compliant queries cited herein have a 
title including the language: “Notice of Compliance Incidents] Regarding FBI’s 
Querying of Raw FISA-Acquired Information Including Information Acquired 
Pursuant to Section 702 of FISA, and Storage of those Query Results.” Those 
notices are cited in the form of “[Filing Date] Notice.” if multiple notices were 
filed on the same date, their citations are distinguished by reference to the relevant 
FBI office.] 


• On December 1,2017, the FBI’s 



• During December 7-11,2017, 

versons 

Apr. 12, 2018, Notice at 2. The 
lose queues advised he did not intend to run 
them against raw FISA information, but nonetheless reviewed raw FISA 
information returned by them. Id. 


• On February 5 and 23, 2018, the FBI’s 
approximate ly 30 queries regard ing potential! 
persons whoH^f^^^^^Rvhere the subject of a 

investigation See June 7, 2018, Notice at 2-3. 



conducted 

ources, e.g., 



• On February 21, 2018, the FBI’s ^^^ ^^^Boonducted approxim ately 45 
queries to retrieve information on persons I 
m^m^^^^^mder consideration as potential sources of information,. See 
May 21,2018, Notice at 2-3. 

The government acknowledges that such queries generally resulted from “fundamental 
misunderstandings by some FBI personnel [about] what the standard ‘reasonably likely to return 
foreign intelligence information’ means.” July 13,2018, Proposed Tr. at 49. 
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In addition, the government has reported queries of information believed to have been 
obtained under Title I or V of FISA (not Section 702) that it characterizes as potentially non- 
compliant. See Prelim. Notice of Possible Compliance Incident Regarding FBI’s Querying of 
Raw FISA-Acquired Information, Apr. 27, 201 27, 2018, Notice”). Those 

queries were governed by a querying standard that requires FBI personnel, “‘[t]o the extent 
reasonably feasible,’” to ‘“design .. . queries to find and extract foreign intelligence information 
or evidence of a crime.’” Id. at 1 (quoting Standard Minimization Procedures for FBI Electronic 
Surveillance and Physical Search Conducted Under FISA, May 17, 2016, § llI.D.3.b at 18). The 
government understands that standard “to mean that the query tenns must be reasonably likely to 
return foreign intelligence information,27, 2018, Notice at 2, which is 
equivalent to the Section 702 standard for foreign-intelligence queries. 

Specifically, the government reported that an unspecified FBI unit “conducted what may 
be considered queries against raw FISA-acquired [metadata]... using what appear to be 

who work 

notice also refers to “queries of the 57,000 identifiers,” vice “individuals.” 

Id.) The date of the queries is not provided, though it is reported that the FBI informed NSD of 
them on April 13, 2018. Id. As of April 27, the government was examining whether the queries 
were reasonably likely to return foreign-intelligence information. Id. At the argument on 
September 28, 2018, counsel for the government advised that internal discussions of the 
adequacy of the justification for those queries were continuing and agreed to update the Court 
within 60 days. Sept. 28, 2018, Proposed Tr. at 30-31. 
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The government has also disclosed misapplications of the FBI querying standard that are 
similar to those described above, except that they involved queries of Section 702 data to return 


information for just one person: 

at 2-3. 

At some time before Ma 



onducted a q uery 
See 



onducted a query on 
before serving a classified order on 



• On October 11,2017. the 

—|to identify cleared personnel on whom to serve process. Fei 
2018, Notice at 2. 




• On November 11, 2017, the FBl’^^^^^^l^onducted a query on a 
potential recipient of a FISA order. Apr. 24,2018, Notice at 2. 

The government has reported a number of other non-compliant queries of Section 702 

information by the FBI, which do not appear to result from comparable misunderstandings of the 


querying standard. Those include: 

• A small number of cases in which FBI personnel apparently conducted queries 
for improper personal reasons - for example, a contract linguist who ran queries 
on himself, other FBI employees, and relatives. See Jan. 30, 2018, Notice at 1-2. 


• A number of instances in which FBI personnel inadvertently ran queries against 
Section 702 information. See, e.g. . May 8, 2018, Notice| 



• A set of queries (overlapping to some extent with the set of inadvertent queries 
of Section 702 data) apparently inteiidg^<y| 2 ui^MT^^^^^^^erial. 
See, e.g. . May 17, 2018, Notice at 2 4 > 

2018, Notice at 2 
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Those instances of non-compliant queries, in the Court’s view, do not present the same level of 
concern as those that evidence misunderstanding of the querying standard. It would be difficult 
to completely prevent personnel from querying data for personal reasons. As a general rule, 
inadvertent queries of Section 702 information and queries intended to retrieve finished 
intelligence reports or other FBI work product do not seem likely to return raw 702 information 
or, if they happen to do so, to result in personnel examining U.S.-person information contained 
therein, the above-described queries regarding 
notwithstanding. 



4. Factors Contributing to the Court’s Concerns 

Of serious concent, however, is the large number of queries evi dencing a _ 

misunderstanding of the querying standard or indifference toward it: lr / JHB 

queries were conducted against the advice of FBI OGC. That concent is heightened by three 
factors: (1) limitations on the government’s oversight mechanisms; (2) the FBI’s policy to 
encourage routine and maximal querying of Section 702 information; and (3) apparent 
complications in applying the querying standard. The Court discusses each. 

a. Limitations on Oversight 

As noted above, in 2017 the FBI conducted over three million queries of FISA-acquired 
information on just one system Supplemental FBI Declaration at 6. In 

contrast, during 2017 NSD conducted oversight of approximately 63,000 queries ii 
274,000 queries in an FBI system ^^^^^^HSee Gov’t Response at 36- 
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Personnel from the Office of Intelligence (Ol) within the Department of Justice’s 
National Security Divsion (NSD) visit about half of the FBI’s field offices for oversight purposes 
in a given year, kh at 35 & n.42. Moreover, 01 understandably devotes more resources to 
offices that useFiSA authorities more frequently, so those offices 

are visited annually, id. at 35 n.42, which necessitates that some other offices go for 
periods of two years or more between oversight visits. The intervals of time between oversight 
visits at a given location may contribute to lengthy delays in detecting querying violations and 
reporting them to the FISC. See, e.g., Jan. 18, 2018, Notice 

ad been conducting improper queries in a training context since 
2011, but the practice was not discovered until 2017). 

When OI does visit a field office, it reviews queries conducted during a specific interval 
f e.g. . 90 days) by a subset of the persons with access to FISA information. See Gov’t Response 
at 35. OI receives from the FBI a list of queries conducted by the designated persons during the 
relevant time, which includes the “query terms, the user who conducted the query, the date and 
time of the query, the system queried,” and in certain cases “information indicating which 
datasets [were] excluded from the query if the user chose to limit or opt out of certain datasets.” 
Id. As discussed above, FBI does not keep records of which terms are U.S.-person query terms. 
Neither do FBI personnel currently memorialize their reasons for believing query terms are 
reasonably likely to return foreign-intelligence information or evidence of crime. In contrast, the 
CIA, NSA, and NCTC are all required to provide written statements of why queries using U.S.- 
person query terms are reasonably likely to return foreign-intelligence information. .See NCTC 
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Querying Procedures § IV.B.2 at 4; CIA Querying Procedures § IV.B,2 at 4; NSA Querying 
Procedures § IV.B. l.d at 4. The FBI does not even record whether a query is intended to return 
foreign-intelligence information or evidence of crime. See July 13, 2018, Proposed Tr. at 14 
(DOJ personnel “try to figure out” from FBI query records which queries were run for evidence- 


of-crime purposes). DOJ personnel ask the relevant FBI personnel to recall and articulate the 


bases for selected queries. Sometimes the FBI personnel report they cannot remember. See 
July 9, 2018. Notice, 

The government contends that “oversight of FBI’s queries is substantial and effective,” 
Gov’t Response at 35, but 01 personnel review only a small portion of the queries conducted and 
the documentation available to them lacks basic information that would assist in identifying 
problematic queries. In particular, it is apparent that contemporaneous documentation of the 
bases for queries would facilitate oversight efforts. By way of comparison, the Court 
understands that the oversight conducted by NSD and the Office of the Director of National 
Intelligence (ODNI) of NSA’s queries makes use of such documentation. See April 26, 2017, 
Opinion at 28 n.32 (“DOJ and ODNI review all U.S.-person identifiers approved for [NSA’s] use 
in querying contents of Section 702-acquired communications as well as the written 
documentation of the foreign intelligence justifications for each such query during bi-monthly 
compliance reviews.”). Given the limitations on the oversight of FBI querying practices, it 
appears entirely possible that further querying violations involving large numbers of U.S.-person 
query terms have escaped the attention of overseers and have not been reported to the Court. 
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b. FBI Policy on Queries 

In addition to articulating the above-described querying standard, the 2016 FBI 
Minimization Procedures require FBI personnel, to the extent reasonably feasible, to design 
queries of Section 702 data to find and extract foreign-intelligence information or evidence of 
crime. See 2016 FBI Minimization Procedures § III.D at 11. They also state it is “a routine and 
encouraged practice for the FBI to query” 702 information in furtherance of authorized 
intelligence and law-enforcement activities, including when “making an initial decision to open 
an assessment.” Id. at 11 n.3. The FISC previously approved FBI minimization procedures 
containing that statement prior to the disclosure of the above-described querying violations. See 
November 6, 2015, Opinion at 29 n.27. The FBI Querying Procedures do not contain the quoted 
language, but the FBI’s policy has not changed. See Supplemental FBI Declaration at 6 (FBI 
uses queries, among other reasons, “to quickly determine whether a new tip or lead ... warrants 
opening an investigation, is related to an existing investigation,” or requires no further action); 
id at 7 (“FBI encourages its personnel to make maximal use of queries - provided they are 
compliant with the FBI’s minimization procedures and other applicable law - in order to perform 
their work.”). 

On the one hand, the FBI is obligated to query Section 7#2 and other FISA information 
only in circumstances satisfying a querying standard that does not apply to FBI information 
generally. On the other hand, it has set up its systems to facilitate running the same query 
simultaneously across FISA and non-FISA datasets, id. at 5, and encourages personnel to make 
maximal use of such queries, even at the earliest investigative stages. Those policy decisions 
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may well help FBI personnel work efficiently and “‘connect dots’” to protect national security, 
id. at 7, but they also create an environment in which unduly lax applications of the Section 702 
querying standard are more likely to occur. 

c. Complications in Applying the Querying Standard 
Delays in reporting some of the querying violations discussed in Part IV.C.3 above 
suggest that FBI and NSD personnel charged with applying the querying standard may lack a 
common understanding of it. On M ay 1, 2018, the governme nt first reported to the FISC noil- 

compliant at t had been examined during 

oversight reviews that took place in March 201.5 and May 20li, respectively. See May 1,2018, 
Notice at 2 n.2. The government did not identity them as non-compliant during those reviews; it 

so only upon the incident and 

“the government’s interpretation of the query provision as reflected in recent compliance 
notices.” May 1,2018, Notice at 2-3. 

Another instanc e of delayed notice concerned the non-compliant queries conducted by the 
Luring March 24-27, 2017. FBI OGC and NSD were aware of the proposal 
to conduct those queries before they were run, and FBI OGC learned they had been conducted on 
March 29, 2017. See Nov. 22, 2017, Notice at 2-3. The government did not notify the FISC, 
however, until November 22, 2017. The government attributed that delay of nearly eight months 
“to the time needed by FBI to gather facts regarding the matter and for the government to 
determine whether the queries were consistent with the FBI minimization procedures.” Id. at 3 
n.6. That sequence of events is similar to the government’s ongoing assessment of the queriese 
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that used approximately 57,000 identifiers for persons In April 2018, the 

government was examining whether that standard was men^nos^uenes, 

Apr. 27, 2018, Notice at 2, and counsel for the government represented at the September 18, 
2018, oral argument that discussions of the FBI’s justifications for those queries were still 
ongoing. Sept. 28, 2018, Proposed Tr. at 30. 

It is reasonable to suspect from the facts available to the Court, including the broad and 
apparently suspicionless nature of those queries, that the government’s prolonged deliberations in 
those matters resulted in part from the lack of a common understanding within FBI and NSD of 
what it means for a query to be reasonably likely to return foreign-intelligence information or 
evidence of crime. The government addressed another set of potentially non-compliant queries at 
the September 28, 201 8, oral argument. Id. at 28-30, ___ _______ .r - 

I 

Kovemmen^eneraH^^TeraKe^nos^uene^T^nionc^na^aMOTmanlvunrectec^r other 
compliance problems and filed on February 15, 2018. See Feb. 15, 2018, Notice at 2 n.l. As of 
that time, the government was “continuing to review whether [certain] queries of raw-FISA 
datasets ... complied with the query standard.” Id. Counsel the 

government reported at the September 28, 2018, oral argument that such examination had not 
been completed and agreed to update the Court within 60 days. Sept. 28, 2018, Proposed Tr. 
at 29-30. 
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Finally, it appears that the government may interpret the FBI querying standard more 
leniently than its language fairly conveys. The FBI Querying Procedures state: “Each query .. . 
must be reasonably likely to retrieve foreign intelligence information .. . or evidence of a crime.. 
.FBI Querying Procedures § IV.A. 1 at 3 (emphasis added), which seems to indicate that each 
individual query must have an adequate justification. The government nonetheless expresses the 
view that an aggregation of individual queries can satisfy the querying standard, even if each 
individual query in isolation would not be reasonably likely to return foreign-intelligence 
information or evidence of crime. Specifically, the government describes a situation in which 
“threat information” indicates “that there is an employee at a cleared defense contractor who has 
access plans to sell September 

2048, Memorandum at 22 n.20, If 100 employees of the contractor are known to have access to 
that technology, the “government assesses that the FBI could run a categorical query of the 
identifiers associated with these 100 employees as there is a reasonable basis to assess that the 
queries would return foreign intelligence information of evidence of a crime.” Id. 

By no stretch of language could one say that an individual query for a randomly selected 
one of those 100 employees would be reasonably likely to return foreign-intelligence information 
or evidence of crime. The government’s assessment that it nonetheless would be permissible to 
query using the identifiers of all 100 employees must rest on the idea that, if those identifiers are 
aggregated and run together in ostensibly a single query, there would be a reasonable likelihood 
that foreign-intelligence information or evidence of crime would be returned. Perhaps in the 
abstract it would be reasonable for the FBI to run such an aggregated query, but it is by no means 
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obvious how such justification-by-aggregation would be consistent with the requirement that 
“[e]ach query” must be reasonably likely to return foreign-intelligence information or evidence of 
crime. See FBI Querying Procedures § IV.A. 1 at 3. 

5. The Governnient’s Response to the Non-Conipliant Queries 

The government has taken steps in response to the FBI’s non-compliance with the 

querying standard. It reports that it now emphasizes issues related to categorical query 

justifications in training, see Gov’t Response at 38, and has promulgated within the FBI detailed 

guidance on querying requirements, which also focused on categorical justifications for queries. 

See id.; July 13, 2018, Proposed Tr. at 50. That guidance recommended consultation with FBI 

lawyers regarding queries based on a “categorical reason,” rather than an “individual reason for 

each identifier.” July 13, 2018, Proposed Tr. at 50. 

As part of the amended procedures submitted on September 18, 2018, the government has 

added to the FBI Querying Procedures a requirement in certain circumstances to consult with an 

FBI attorney regarding queries supported by categorical justifications. That provision, which 

apparently fonnalizes a version of the above-noted recommendation, states: 

Prior to reviewing the unminimzed content of section 702-acquired information 
retrieved using a categorical batch query (as opposed to queries conducted on the 
basis of individualized assessments), FBI personnel will obtain approval from an 
attorney from either their Chief Division Counsel’s Office or the National 
Security and Cyber Law Branch. This requirement does not apply if the persons 
whose identifiers are queried are (1) targets of lawful collection, (2) subjects of 
predicated investigations, or (3) in contact with targets of lawful collection or 
subjects of predicated investigation. Approvals to review the content returned by 
such queries will include a justification for the queries, the approving official, and 
the duration of such approval, 

FBI Querying Procedures § IV.A.3 at 4 (emphasis added). 
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The government apparently promulgated the enhanced guidance in June 2018. See Gov’t 
Response at 38 (guidance “expected to be provided to appropriate FBI personnel in June 2018”). 
There accordingly has been insufficient time to assess its effect. As to Section IV.A.3, the 
requirement to consult with an attorney applies in narrow circumstances: after a categorical batch 
query has been conducted and prior to FBI personnel’s reviewing content information returned 
by the query, unless one of three exceptions applies. The government explains that the provision 
is “tailored to focus on a particular type of query that potentially presents greater compliance risk 
and privacy impact” - those “based on a categorical, rather than individualized, justification.” 

See September 18, 2018, Memorandum at 21. At the oral argument on September 18, 2018, 
counsel for the government stated that querying to retrieve information regarding as few as two 
persons, based on a common justification, would be regarded as a categorical batch query for 
puiposes of § IV.A.3. Sept. 28, 2018, Proposed Tr. at 24, 26. 

6. Analysis 

The Court finds that the FBI’s Section 702 minimization procedures, as they have been 
implemented, are not consistent with the requirements of Section 1801 (h)(l) and (h)(3), or tire 
Fourth Amendment. 

a. Statutory Deficiency 

As noted above, minimization procedures must be 

reasonably designed in light of the purpose and technique of the particular 
surveillance, to minimize ... the retention, and prohibit the dissemination, of 
nonpublicly available information concerning unconsenting United States persons 
consistent with the need of the United States to obtain, produce, and disseminate 
foreign intelligence information. 
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§ 1801(h)(1). In this case, the “purpose and technique” of Section 702 collection involvese 
targeting non-U.S. persons reasonably believed to be located outside the United States to obtain 
foreign-intelligence information with the assistance of communications service providers. See 
§ 702(a), (b)(3), (i)(l). Those acquisitions include the contents of communications to or from 
non-target U.S. persons. Queries that are in fact reasonably likely to return foreign-intelligence 
information are responsive the government’s need to obtain and produce foreign-intelligence 
information, and ultimately to disseminate such information when warranted. For that reason, 
queries that comply with the querying standard comport with § 1801(h), even insofar as they 
result in the examination of the contents of private communications to or from U.S. persons. On 
the other hand, queries that lack a sufficient basis are not reasonably related to foreign- 
intelligence needs and any resulting intrusion on U.S. persons’ privacy lacks any justification 
recognized by § 1801 (h)(1). Because the FBI procedures, as implemented, have involved a large 
number of unjustified queries conducted to retrieve information about U.S. persons, they are not 
reasonably designed, in light of the puipose and technique of Section 702 acquisitions, to 
minimize the retention and prohibit the dissemination of private U.S. person information. 

With regard to evidence-of-crime queries, the FISC has previously found that by 
providing for minimization procedures that permit the retention and dissemination of evidence of 
crime for law-enforcement purposes, Section 1801 (h)(3) fairly contemplates queries reasonably 
designed to return evidence of crime. See November 6, 2015, Opinion at 32-33. The issue in 
this case, however, is the prevalence of FBI queries that were unlikely to return evidence of crime 
(even though they may have been subjectively intended to do so). The government has not 
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argued that Section 1801(h)(3) permits such queries, and the Court declines to adopt such a 

conclusion. 

The Court also has considered carefully whether the recently improved guidance and 
training referenced by the government adequately addresses the problems with the FBI’s 
querying practices such that the Court should find that the FBI’s querying and minimization 
procedures, as amended, comport with § 1801 (h). It has concluded that, while the government 
has taken constructive steps, they do not adequately justify such a finding. 

First, as discussed above in Part IV,C,2, many, though not all, recent misapplications of 
the querying standard by the FBI involved categorical batch queries. More significantly, the 
Court is doubtful that in practice FBI personnel will consistently channel categorical batch 
queries into § IV.A.3’s approval process before they examine content information retrieved by 
those queries. As stated in § IV. A.3, a query conducted on the basis of an individualized 
assessment is not a categorical batch query. Implementation of § IV. A.3 will depend on the 
ability of the FBI’s front-line personnel to determine which queries are supported by 
individualized assessments, and therefore not subject to the approval requirement of § IV.A.3, 
and which rely on categorical justifications and are subject to the approval requirement. Given 
the documented misunderstandings of the querying standard among FBI personnel, the 
government’s reliance on them to make those distinctions seems misplaced. Indeed, the 
personnel most in need of guidance from an attorney may not receive it because they have 
difficulty in determining when they are supposed to consult with one. 
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Finally, the broad exceptions to Section IV.AJ’s approval requirement are also of 

concern. Most notably, one of those exceptions applies if the persons whose identifiers are 
queried are “in contact with targets of lawful collection or subjects of predicated investigations.” 
§dV.A.3. There are two levels of FBI predicated investigations: full and preliminary. See Att’ya 
General Guidelines for Domestic FBI Operations § 11.B.4 at 21, Sept. 29,2008. The FBI may 
initiate a full investigation “if there is an articulable factual basis for the investigation that 
reasonably indicates” that, for example: 

a. aAn activity constituting a federal crime ora threat to the national security has 
or may have occurred, is or may be occurring, or will or may occur and thea 
investigation may obtain information relating to the activity or the involvement ora 
role of an individual, group, or organization in such activity^; or]a 

b. aAn individual, group, organization, entity, information, property, or activity is 
or may be a target of attack, victimization, acquisition, infiltration, or recruitmenta 
in connection with criminal activity in violation of federal law or a threat to thea 
national security and the investigation may obtain information that would help toa 
protect against such activity or threat.a 

Id. at §§ II.B.3, Il.B.4.b.i at 21-22 (emphasis added). The FBI may open a preliminary 
investigation with even less of a factual predicate: “on the basis of information or an allegation 
indicating the existence of a circumstance” described in paragraph a. or b. above. Id. § lI.B.4.a.i 
at 21 (emphasis added). A query using identifiers for persons known to have had contact with 
any subject of a full or preliminary investigation would not require attorney approval under 
§ IV. A.3, regardless of the factual basis for opening the investigation or how it has progresseda 
since then. 
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b. Fourth Amendment Deficiency 

Applying the totality-of-circumstances analysis the FISC employed in previous Section 
702 proceedings, the Court finds that the FBI Minimization Procedures and Querying Procedures 
are similarly unreasonable under the Fourth Amendment. 

(i) Applicable Fourth Amendment Framework 

The Fourth Amendment states: 

The right of the people to be secure in their persons, houses, papers, and effects, 
against unreasonable searches and seizures, shall not be violated, and no Warrants 
shall issue, but upon probable cause, supported by Oath or affirmation, and 
particularly describing the place to be searched, and the persons or things to be 
seized. 

U.S, Const, amend, IV. 

“The touchstone of the Fourth Amendment is reasonableness.” In re Certified Question 
of Law. 858 F.3d 591,604 (FISA Ct. Rev. 2016) (per curiam) (“In re Certified Question”). 
Although “[t]he warrant requirement is generally a tolerable proxy for ‘reasonableness’ when the 
government is seeking to unearth evidence of criminal wrongdoing,. . . it fails properly to 
balance the interests at stake when the government is instead seeking to preserve and protect the 
nation’s security from foreign threat,” Id at 593. Accordingly, a warrant is not required to 
conduct surveillance “to obtain foreign intelligence for national security purposes ... directed 
against foreign powers or agents of foreign powers reasonably believed to be located outside the 
United States.” See In re Directives Pursuant to Section 105B of FISA. 551 F.3d 1004, 1012 
(FISA Ct. Rev. 2008) (“In re Directives”). The FISC has repeatedly reached the same conclusion 
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regarding Section 702 acquisitions. See. e.u„ November 6, 2015, Opinion at 36-37; 

September 4, 2008 Opinion at 34-36. 

In assessing the reasonableness of a governmental intrusion under the Fourth 
Amendment, a court must “balance the interests at stake” under the “totality of the 
circumstances.” In re Directives. 551 F.3d at 1012. In prior reviews of Section 702 procedures, 
the FISC has assessed the reasonableness of the government’s procedures as a whole, rather than 
separately analyzing the reasonableness of discrete forms of action taken thereunder, such as 
querying. See, e.g.. November 6, 2015, Opinion at 39 (assessing “the combined effect” of the 
targeting and minimization procedures ). 

Amici, however, argue that the Court should regard querying as a separate Fourth 
Amendment event subject to its own reasonableness analysis. See Amici Brief at 57-59. First, 
they contend that the Reauthorization Act mandates that the querying procedures be 
constitutional in their own right. Id. at 48 (“Section 101 requires the Attorney General, in 
consultation with the DNI, to establish Querying Procedures relating to 702-acquired infonnation 
that comport with the Fourth Amendment” and citing § 702(f)). Amici also point to Section 
702(f)(2), which requires the FBI, in specified narrow circumstances, to obtain a FISC order 
before examining content information retrieved by querying Section 702 data, as mandating a 
change to the Court’s analysis. See id. Amici argue that by enacting that requirement “Congress 
has acknowledged the reality that FBI agents querying databases containing raw 702 infonnation 
for a variety of purposes are, in effect, undertaking new ‘searches,’ some of which now require a 
court order.” Amici Brief at 56-57. 
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Amici also argue that reviewing querying as an independent Fourth Amendment event 
would be in line with evolving case law. See id. at 57 (citing Rilev v. California. 134 S.Ct. 2473, 
2493 (2014), as “requiring law enforcement to obtain a warrant before searching a cell phone 
lawfully seized incident to arrest”); see also id. at 58 (citing Walter v. United States. 447 U.S. 
649, 654 (1980), United States v. Mulder. 808 F.2d 1346 (9th Cir. 1987), United States v. 
Bowman. 215 F.3d 951 (9th Cir. 2001) and United States v. Runyan, 275 F.3d 449, 461 (5th Cir. 
2001), for the proposition that “even if law enforcement comes into possession of an object 
lawfully because it has been seized or searched by a private party, subsequent actions taken by 
law enforcement to inspect or review the object’s contents constitute separate events for puiposes 
of the Fourth Amendment”). Amici also point to the recent holding in Carpenter v. United 
States, 138 S,Ct. 2206 (2018), for further support. See July 13, 2018, Proposed Tr. at 37. They 
analogize (1) a cellular-phone provider’s collection of cell-site location information (CSLI) to the 
government’s acquisition of Section 702 information, and (2) the provider’s subsequent 
compiling and production to the government of CSLI revealing the location of a particular 
suspect over time to the FBI’s subsequent querying of Section 702 information for a particular 
U.S. person. Based on those analogies, they contend that the Supreme Court’s holding in 
Carpenter that the government’s obtaining and accessing CSLI information involved a search 
under the Fourth Amendment has implications for whether querying Section 702 data might also 
be a Fourth Amendment search. See id. 

The Court has considered these authorities and declines to find that they require that 
querying of information lawfully acquired under Section 702 be considered a distinct Fourth 
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Amendment event requiring a reasonableness determination independent of the other 
circumstances of acquisition. 

With regard to the Reauthorization Act, the provisions cited by amici reflect 
congressional views on the reasonableness of certain querying practices and strongly suggest 
congressional recognition that Fourth Amendment concerns are implicated by the querying of 
Section 702 infonnation. Their effect, however, is to expand statutory protections, not the scope 
of what constitutes an independent search under the Fourth Amendment. 

The Court also declines to find that the case law cited by amici mandate that queries of 
Section 702 infonnation be considered distinct Fourth Amendment events. Three of the cases 
involved property voluntarily provided to law enforcement by a third party and subsequent law- 
enforcement searches that exceeded the scope of the prior examination by that third party. See 
Walter. 447 U.S. at 654-57 (finding that FBI’s screening of films that had been contained in 
shipment mistakenly sent to and opened by third party violated Fourth Amendment); Runyan . 

275 F.3d at 464 (finding that police examination of compact disks that had not been viewed by 
third party who turned them over violated Fourth Amendment); Bowman. 215 U.S. at 963 
(government conceded that viewing of film contained in footlocker provided by third party 
exceeded third party’s prior examination), In Mulder, the court found that toxicology lab tests of 
tablets, which a hotel employee had turned over to law enforcement, exceeded the scope of the 
“field test” exception to the warrant requirement. Mulder. 808 F.2d at 1348-49 (citing United 
States v. Jacobsen. 466 U.S. 109, 123(1984)). None of these cases is instructive regarding 
circumstances like those present in this case, which involve the government’s examination of 
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information lawfully acquired under a statutory framework that requires a judicial determination 

that the totality of attendant circumstances, including the government’s acquisition, retention, 

use, and dissemination of such information, is reasonable under the Fourth Amendment. 

In any event, the Court arrives at the same conclusions as amici, albeit under a totality-of- 

circumstances analysis: the FBI’s procedures are unreasonable under the Fourth Amendment and 

the ainici’s proposal to require the FBI to document the basis for its queries in certain additional 

circumstances, see Part 1V.C.7 below, would cure that deficiency. 

(ii) Reasonableness Under the Totality of Circumstances 

Under the totality-of-circuinstances approach, a court must balance ‘“the degree to which 

[governmental action] intrudes upon an individual’s privacy’” against “‘the degree to which it is 

needed for the promotion of legitimate governmental interests.’” In re Certified Question. 858 

F.3d at 604-05 (quoting Wyoming v. Houghton, 526 U.S. 295, 300 (1999)). “The moree 

important the government’s interest, the greater the intrusion that may be constitutionally 

tolerated.” In re Directives, 551 F.3datl012. 

If the protections that are in place for individual privacy interests are sufficient in 
light of the governmental interest at stake, the constitutional scales will tilt in 
favor of upholding the government’s actions. If, however, those protections are 
insufficient to alleviate the risks of government error and abuse > the scales will tip 
toward a finding of unconstitutionality. 

Id. (emphasis added). 

The Court regards the privacy interests at stake as substantial. As described above in 
Pail IV.C.3, the FBI has conducted tens of thousands of unjustified queries of Section 702 data. 

ind for 

■**!**— Page 88 


Based on the information available -e.g., queries for 
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persons with access to FBI facilities - it appears that many subjects of those queries were U.S. 
persons. Beyond that, it is difficult on the record before the Court to assess to what extent U.S.- 
person information was returned and examined as a result of those queries. At a minimum, 
however, the reported querying practices present a serious risk of unwarranted intrusion into the 
private communications of a large number of U.S. persons. 

The Court believes that serious risk weighs substantially in the assessment of 
reasonableness. The goal of the Fourth Amendment is to protect individuals from arbitrary 
governmental intrusions on their privacy. See Carpenter. 138 S. Ct. at 2213 (‘“basic purpose’” of 
the Fourth Amendment ‘“is to safeguard the privacy and security of individuals against arbitrary 
invasions by governmental officials’”) (quoting Camara v. Municipal Court of City and County 
of San Francisco. 387 U.S. 523, 528 (1967)). The FBI’s use of unjustified queries squarely 
implicates that purpose: the FBI searched for, and presumably examined when found, private 
communications of particular U.S. persons on arbitrary grounds K '* V’ * y * 

y v- rtPB See 

Part IV.C.3 above. 

The government is not at liberty to do whatever it wishes with those U.S.-person 
communications, notwithstanding that they are “incidental collections occurring as a result of’ 
authorized acquisitions. In re Directives. 551 F.3d at 1015. The FISCR in In re Directives relied 
on the government’s assurance “that it does not maintain a database of incidentally collected 
information from non-targeted United States persons” when it held on the facts of that case that 
“incidentally collected communications of non-targeted United States persons do not violate the 
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Fourth Amendment.” Id. In this matter, while the FBI may not maintain a separate database of 
U.S.-person communications acquired under Section 702, it routinely queries raw Section 702e 
data in order to identify and examine communications of particular U.S. persons. Whether those 
querying practices adequately protect the privacy of those U.S. persons, or instead unjustifiably 
invade U.S. persons’ privacy, bears on the analysis of reasonableness under the Fourth 
Amendment. See In re Certified Question. 858 F.3d at 609 (examining intra-FBI restrictions on 
access to information acquired pursuant to a FISA pen register/trap-and-trace authorization as 
part of assessment of Fourth Amendment reasonableness). 

Under the totality-of-circumstances framework, the Court must take into account 
protections afforded by other provisions of tire government’s procedures and assess whether their 
combined effect is reasonable under the Fourth Amendment. Those protections include 
requirements in the targeting procedures that “direct the government’s acquisitions toward 
communications that are likely to yield foreign intelligence information” and “substantial 
restrictions on the use and dissemination of information derived from queries.” November 6, 
2015, Opinion at 41-42. Compliance with those provisions mitigates the intrusion on U.S. 
persons’ privacy resulting from unjustified queries, either by limiting the scope of information 
acquired and therefore subject to querying or limiting the further use or disclosure of U.S.-person 
information returned by queries. The Court nonetheless views as substantial the intrusion on 
U.S. persons’ privacy inherent in FBI personnel’s examination of information - especially 
content information - returned by unjustified U.S.-person queries. 
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On the other side of the balance, it must be acknowledged that acquiring “foreign 
intelligence with an eye toward safeguarding the nation’s security serves ... a particularly 
intense interest.” In re Certified #uestion. 858 F.3d at 606 (internal quotation marks omitted). 
For that reason, the FISCR has observed that “the government’s investigative interest in cases 
arising under FISA is at the highest level and weighs heavily in the constitutional balancing 
process,” Id. at 608. The Court must also consider, however, the degree to which the 
governmental action in question is needed for the promotion of the relevant governmental 
interest. Id. at 6#5. Here, the relevant governmental action is the FBI’s continuing to run queries 
without taking further measures to ensure they actually satisfy the querying standard FBI 
personnel are supposed to apply. 

Whether the balance of interests ultimately tips in favor of finding the procedures to be 
inconsistent with the Fourth Amendment is a close question. Reasonableness under the Fourth 
Amendment does not require perfection. See In Re Directives. 551 F.3d at 1015 (“the fact that 
there is some potential tor error is not a sufficient reason to invalidate” surveillances as 
unreasonable under the Fourth Amendment). Nonetheless, if “the protections that are in place 
for individual privacy interests are ... insufficient to alleviate the risks of government error and 
abuse, the scales will tip toward a finding of unconstitutionality.” M. at 1012. Here, there are 
demonstrated risks of serious error and abuse, and the Court has found the government’s 
procedures do not sufficiently guard against that risk, for reasons explained above in the 
discussion of statutory minimization requirements. 
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Finally, for reasons explained below, the government has not made a persuasive case that 

the documentation requirement proposed by amici, which would provide a further check against 
unjustified intrusions on the privacy of U.S. persons and should also enhance oversight of FBI 
queries, would impede the FBI’s ability to respond to national-security threats. On the current 
record and subject to future oversight of the FBI’s querying practices, the Court believes that its 
adoption would remedy the statutory and Fourth Amendment deficiencies discussed above. 

The Court accordingly finds that the FBI’s querying procedures and minimization 
procedures are not consistent with the requirements of the Fourth Amendment. 

7.e Amici’s Documentation Proposal as a Remedy 

The government offers § IV.A.3 in part as an alternative to a proposal made by amici. See 
September 18, 2018, Memorandum at 21. Amici propose that FBI personnel be required to 
document in writing their bases for believing that queries of Section 702 data using U.S.-person 
query terms were reasonably likely to return foreign-intelligence information or evidence of crime 
before they examine content information returned by such queries. See Amici Brief at 69, 72. 
(Amici alternatively discussed a more far-reaching requirement to document the basis for queries 
before they are conducted, see July 13, 2018, Proposed Tr. at 34, but stated at the September 28, 
2018, argument that the above-described option would be adequate. The FISC declined to adopt a 
pre-querying documentation requirement in a prior Section 702 proceeding, seeNovember 6,2015, 
Opinion at 39-41, though the record in that case did not reflect similar problems with the FBI’s 
querying practices.) 
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Like § IV.A.3, the documentation requirement proposed by amici would apply only when 
a query has returner! Section 712-acquired content information that FBI personnel wish to 
examine. The amici proposal is further limited to U.S.-person queries. Because of those 
limitations, it applies only to the subset of queries that are particularly likely to result in 
significant intrusion into U.S. persons’ privacy. In contrast to § IV.A.3, the documentation 
requirement proposed by amici would impose a less onerous requirement on FBI personnel who 
wish to examine such contents (written memorialization of the basis for the query vs. attorney 
approval), but in a larger number of cases (U.S.-person queries vs. categorical batch queries). 

In the Court’s assessment, the documentation requirement proposed by amici would 
facilitate oversight of queries likely to have intruded on U.S. persons’ privacy interests by 
providing contemporaneous documentation of why FBI personnel believed the querying standard 
was satisfied. The requirement to create that documentation would also help ensure that FBI 
personnel, in fact, have thought about the querying standard and articulated why they believe it 
has been met. By so doing, it would prompt FBI personnel - much more frequently than the 
attorney-approval process under § IV.A.3 to recall and apply the guidance and training they 
have received on the querying standard. Over time and with review by oversight personnel, those 
written statements may also suggest how to improve that guidance and training, or even the 
formulation of the standard in the querying procedures. 

The government, however, objects that such a requirement would not be effective and 
would unduly burden and hinder the FBI’s work. Regarding effectiveness, the government 
contends that such a documentation requirement would not have prevented the most serious 
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reported instanc^^AMi-compliance, such as the queries performed afj] 
for persons witf^^^Hjuly 13, 2018, Proposed Tr. at 12. In the government's estimation, the 
relevant personnel in those cases mistakenly but genuinely thought they had a sufficient basis for 
the queries, so they would have documented that basis and proceeded to examine the content 
information retrieved. See Gov’t Response at 36-37; July 13,2018, Proposed Tr. at 9-10. The 
Court has not heard from the personnel who conducted those non-compliant queries and is not 
well positioned to assess what courses of action they would have taken if they had been obligated 
to state in writing why they thought the queries were justified. But it accords with common sense 
and experience that some persons in comparable circumstances may, as amici suggest, realize 
their queries “could not be justified” when they are required to articulate the justification. See 
Amici Brief at 54. 

The government further objects that requiring a written justification to examine the 
contents provided in response to U.S.-person queries of Section 702 information “would 
substantially hinder the FBI’s ability to investigate and protect against threats to national 
security.” Supplemental FBI Declaration at 17. Different forms of hindrance are claimed. 

First, the government identifies burdens and potential error costs associated with 
identifying which terms are U.S.-person query terms. Ick at 15; July 13, 2018, Proposed Tr. 
at 13,15. But those are the same burdens and costs anticipated by the government with regard to 
the statutoiy obligation to keep records that differentiate U.S.-person query terms from other 
terms. See Part IV.B.2.C above. If for some reason, moreover, FBI personnel are in doubt about 
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whether a particular query used a U.S.-person query term, they can always choose to document 
the justification for the query rather than try to resolve that doubt. 

The government also assesses that “there is a substantial likelihood” that the impact on 

the FBI’s “resources and operations” of amici’s documentation proposal “would be significant.” 

< 

Supplemental FBI Declaration at lb. The government is not, however, able to quantify that 
impact. Id. at 15-16. For example, given the above-described FBI recordkeeping practices, it 
cannot say how often the FBI conducts U.S.-person queries, nor can it state how often queries 
return content information acquired under Section 702, .id. at 6 n.3, or how often FBI personnel 
review FISA information returned in response to a query. Id at 15-16. The government does 
acknowledge, however, that a U.S.-person query of Section 702 information may not return any 
such information, and even if it does, the FBI may not review it. See Gov’t Response at 35 n.41. 
In either of those situations, the documentation requirement would not apply. 

The government nonetheless contends that “a requirement that FBI must include a written 
justification prior to reviewing any section 702-acquired results that are returned using a U.S. 
person query term would . .. hinder the FBI’s ability to perform its national security and public 
safety missions.” Supplemental FBI Declaration at 15 (emphasis added). But the burden 
associated with documenting the basis for any particular query should be minimal. FBI 
personnel must determine that every query they conduct is reasonably likely to return foreign- 
intelligence information or evidence of a crime before they run it. See Gov’t Response at 33-34 
(“The lack of a requirement for written documentation of the query justification does not mean 
that FBI personnel are not required to have a justification for each query” and they are “required 
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to have a justification for each query of raw FlSA-acquired information, as each query lias to 

meet the substantive query standard . . . .”). For that reason, memorializing the basis for a query 

should involve no additional research or analysis. Nor should composing the written statement 

be time consuming. The Court contemplates a brief statement of the query justification - in 

many cases it should suffice to succinctly complete a sentence that starts “This query is 

reasonably likely to return foreign-intelligence information [or evidence of crime] because 

At the heart of the government’s objections to the documentation requirement proposed 

by amici is an understandable desire to ensure that FBI personnel can 

perform their work with the utmost efficiency and “connect dots” in an effort to 
protect the national security. Given the lessons learned following 9/11 and the 
Fort Hood shooting, as well as the FBI’s significant reliance on queries to 
effectively and efficiently identify threat streams in its holdings, the FBI is 
extremely concerned about anything that would impede, delay, or create a 
disincentive to querying FBI databases. 

Supplemental FBI Declaration at 7 (emphasis added). But amici’s documentation proposal 
would in no way affect the FBI’s ability to queiy its databases. Only if a U.S.-person ^uery 
returns Section 702 content information and the FBI decides to review that information is the 
documentation requirement triggered. Non-content metadata, which may help the FBI “connect 
the dots,” will be immediately available without having to document the basis for a query. And 
FBI personnel could dispense with the otherwise-required documentation if needed to protect 
against an immediate threat to human life. See FBI Querying Procedures § II at 1. 

The Court regards amici’s documentation proposal as a measured and reasonable 
response to the statutory and Fourth Amendment deficiencies it has found in the FBI’s 
implementation of its querying standard. The Court believes that adopting and implementing 
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that proposal, in combination with the other protections of the FBI Querying Procedures and FBI 
Minimization Procedures, would satisfy the definition of “minimization procedures” at § 1801(h) 
and render those procedures consistent with the requirements of the Fourth Amendment. Indeed, 
while other modifications to the procedures could have the same effect, it is difficult to conceive 
of their doing so while imposing so modest a burden on the FBI’s work. 

D. Exemptions in the Minimization and Querying Procedures 
The minimization and querying procedures proposed by the government contain several 
exemptions for activities relating to oversight and training, as well as activities responsive to 
congressional mandates. Although the Court assessed that the oversight and training exemptions 
included in the March 27, 2018, Submission were unreasonably broad, it concludes that the 
revised exemptions in the September 18, 2018, Submission comport with the statutory 
requirements and the Fourth Amendment. 

1. Exemptions for Oversight Activities 
One broad category of exemptions proposed by the government in March 2018 concerned 
oversight activities conducted by independent executive-branch entities or the agencies 
themselves. 

The first type of exemption, which is not new, addresses oversight conducted by 
independent executive-branch entities. This exemption is included in each of the four sets of 
minimization procedures. For example, Section 1 of NS A’s proposed minimization procedures 
provides: “Nothing in these procedures shall restrict the lawful oversight functions of [NSD, 
ODNI] or the applicable Offices of the Inspectors General, or the provision by NSA of the 
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assistance necessary for these entities to perform their lawful oversight functions.” March 27, 
2018, NSA Minimization Procedures § 1 at 1; see also March 27, 2018, FBI Minimization 
Procedures § 1. Gat 4; March 27, 2018, CIA Minimization Procedures § 6.f at 4; March 27, 2018, 
NCTC Minimization Procedures § 6.e at 4. The initially proposed querying procedures 
contained a similar provision, see March 27, 2018, Querying Procedures § Ilfeat 1, which is 
canned forward in the amended querying procedures for each agency submitted in September 
2018. See FBI Querying Procedures § IV.C at 5; NSA Querying Procedures § IV.C at 5; CIA 
Quetying Procedures § IV.C at 4; and NCTC Querying Procedures § IV.C at 4. 

The second type of exemption - for oversight conducted by the agencies themselves - 
was quite broad as initially proposed by the government. For example, the exemption initially 
proposed for FBI provided: 

[N}o|thing in these procedures shall restrict the FBI’s performance bf lawful 
Oversight functions (of its personnel or systems, which includes activities 
performed: in supploftsf FBI’s investigation and remediation of a possible 



Division and Records Management Division audits. 

March 27, 2018, FBI Minimization Procedures § I.Hat 4. The minimization procedures 
proposed for the other three agencies contained similar exemptions. See March 27, 2018, NSA 
Minimization Procedures § 1 at 2; March 27, 2018, CIA Minimization Procedures § 6.h at 5; 
March 27, 2018, NCTC Minimization Procedures § 6.g at 4. 

Amici challenged the breadth of these proposed exemptions as insufficiently defined, see 
Amici Brief at 63-67, 82-84, and asserted the exemptions allow any deviation from otherwise- 
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applicable restrictions u no matter how disproportionate the Government’s purpose may be to the 
deviation,” Amici Reply at 13, and “do not aim for a reasonable balance between the 
Government’s interest in performing ... oversight, on the one hand, and the privacy interest of 
U.S. persons affected by deviations from the procedures on the other ...JdL at 13-14. 

In support of the lawful-oversight exemption, the government emphasized that the 
exemption furthers its interest in ensuring that the Section 702 procedures are correctly 
implemented, which should increase protection of U.S. persons’ privacy. See Gov’t Response 
at 21 (asserting “a strong government interest in supervising personnel to mitigate the risk of 
non-compliance by government employees accessing raw section 702 information”); id, at 43 
(the exemption “permits the government to engage in essential oversight activities that in fact 
promote the privacy interests of U.S. persons”). The government also contended that the 
proposed exemption provided greater specificity without expanding the scope of exempted 
conduct as previously approved by the FISC. See Gov’t Response at 42-43. 

The Court did not accept the government’s premise that the proposed modifications 
resulted in exemptions that were no broader than those previously approved. Although similar 
language did appear in previously approved minimization procedures, the government did not 
disclose, nor did the Court recognize, how broadly the government understood “lawful oversight 
functions” until June 2017. In an attempt to mitigate the scope of the minimization violations 
raised by t he FBI’s r etention of unminimized Section 702-acquired information in repositories 
containinj^^^^Jclassified email and instant messages (see Part IV.E.2 below), the 
government articulated a view of “lawful oversight functions” that spanned a wide range of 
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disparate functions, such as overseeing compliance with federal records-management 
requirements, identifying executive-level email messages subject to an archiving requirement 
imposed by the National Archives and Records Administration, and conducting I 

See Report Regarding Retention of Raw FISA-Acquired Information in Certain FBI Special 
Purpose Systems, June 16, 2017, at 4-5, 10-12. The Court, moreover, agreed with amici 
regarding the unjustified breadth and lack of specificity of the lawful-oversight exemption 
initially proposed by the government. 

In response to those concerns, the government significantly modified the proposed 
exemption. In the modified procedures submitted on September 18, 2018, it described more 
particularly the types of activity conducted by each agency that constitute lawful-oversight 
functions. For example, the FBI’s modified procedures identify the following types of activity as 
lawful-oversight functions: (1) review of Section 702-acquired information the FBI determines is 
necessary to remediate a potential spill of Section 702-acquired information; (2) review, 
retention, and disclosure of Section 702-acquired information subject to destruction, including 
under these minimization procedures; and (3) review and retention of unminimized Section 702- 
acquired information contained in employee electronic communications by the FBI’s Inspection 
Division, as part of its record of what it has provided to the Office of the Inspector General, See 
September 18,2018, FBI Minimization Procedures § II.II at 5. Notably, the amended provisions 
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The modified provision also limits the scope of the authorized deviation by requiring 
(1 Compliance with the minimization procedures to the maximum extent practicable, see e 
September 18, 2018, NSA Minimization Procedures § 2 at 3; September 18, 2018, FBI 
Minimization Procedures § I.H at 5 n.4; September 18, 2018, CIA Minimization Procedures § 6 
at 4 n.2; September 18, 2018, NCTC Minimization Procedures § A.6 at 4 n.l: and (2) destruction 
of information in accordance with the applicable procedures once it is no longer reasonably 
believed to be necessary to the lawful-oversight function. See September 18, 2018, NSA 
Minimization Procedures § 2(b)(5) at 2; September 18, 2018, FBI Minimization Procedures § I.H 
at 6; September 18, 2018, CIA Minimization Procedures § 6.i at 5; and September 18, 2018, 
NCTC Minimization Procedures § A.6.g at 4-5. 

Each agency is also permitted to deviate from the procedures when necessary to conduct 
lawful-oversight functions that are not described in the procedures, but only after consultation 
with NSD and #DN1, followed by prompt reporting of the deviation to the FISC. See 
September 18, 2018, NSA Minimization Procedures § 2(b)(5) at 2; September 18,2018, FBI 
Minimization Procedures § I.H at 5-6; September 18, 2018, CIA Minimization Procedures § 6.i 
at 5; September 18,2018, NCTC Minimization Procedures § A.6.g at 4. At the hearing on 
September 28, 2018, the government confirmed that this provision is not intended to include 
activiuijf related to invc.s' id ■; -ns o ^ ^ * Uu 

See September 28, 2018, Proposed Tr. at 12-13. 


Page If] 


DATE: Oct 8, 2019 - Authorized Public Release 


Page 101 of 138 


FISC Opinion. Oct 2018 





Document regarding the Section 702 2018 Certification 


ODNI Authorized for Public Release 


The amended querying procedures contain corresponding exemptions. For example, 
NSA’s provide: 

[NJothing in these procedures shall prohibit NSA from conducting queries it 
determines are necessary to: .. . perform the following lawful oversight functions 
of NSA’s personnel or systems: 

a. esuppoit NSA’s investigation and remediation of a possible section 702e 
compliance incidence 

b. eremediate a potential spill «f classified section 702-acquired information ine 
NSA systems;e 

c. adentify section 702-acquired information subject to destruction, includinge 
under NSA’s section 702 minimization procedures;e 

d. eensure the effective application of marking or segregation requirements in 
NSA’s section 702 minimization procedures; and 

e. support NSA’s audit or review, for quality control puiposes, of work done 
related to section 702 collection by NSA personnel[.] 

NSA Querying Procedures § C.6 at 5-6 (followed by corresponding catchall provision permitting 

deviations from querying procedures for unspecified lawful-oversight functions after consultation 

with NSD and ODNI followed by prompt reporting to the FISC); see also CIA Querying 

Procedures § IV.C.7 at 5 (similar); NCTC Querying Procedures § IV.C.6 at 5 (similar); and FBI 


Querying Procedures § IV.C.7 at 6 (delineating similar exemptions as well as an exemption for 
queries conducted to “assess compliance with federal record-keeping requirements, where such 
queries are conducted audit and oversight systems, as defined in FBI’s 

section 702 minimization procedures, that contain FBI personnel e-mails 
that may contain unminimized section 702-acquired information”). 

The Court is satisfied that the exemptions for lawful-oversight functions conducted by the 
agencies are sufficiently defined and no broader than reasonable to permit the effective exercise 
of those functions. To the extent the need to conduct additional but unspecified lawful-oversight 
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activities arises and those activities require deviation from applicable procedures, the Court 
views the required pre-implementation consultation with NSD and ODNI and prompt 
notification to the FISC as reasonable means of monitoring and, if necessary, checking any other 
deviations from applicable procedures based on the lawful-oversight exemption. 

2. Exemptions for Training Activities 
Each agency’s initially proposed minimization procedures also contained a broad 
exemption from otherwise-applicable rules for activities conducted during training or for system- 
administration purposes. See March 27, 2018, NSA Minimization Procedures § 1 at 1 (“Nothing 
in these procedures shall restrict NSA’s performance of lawful training functions of its personnel 
or activities undertaken for creating, testing, or maintaining its systems.”); March 27, 2018, FBI 
Minimization Procedures § I.G at 4 (“Nothing in these procedures shall restrict the FBI’s 
performance of lawful training functions of its personnel or creating, testing, or maintaining the 
functions of its systems.”); March 27, 2018, CIA Minimization Procedures § A.6.g at 4-5 
(“Nothing in these procedures shall prohibit. . . CIA’s performance of lawful training functions 
of its personnel, or activities undertaken for creating, testing, or maintaining its systems.”); 

March 27, 2#18, NCTC Minimization Procedures § A.6.f at 4 (“Nothing in these procedures 
shall prohibit.. . NCTC’s performance of lawful training functions of its personnel, or creating, 
testing, or maintaining its systems.”). A similar provision was included in the querying 
provisions. See March 27, 2018, Querying Procedures § III at 1 (“Nothing in these procedures 
shall restrict a covered agency’s performance of lawful training functions of its personnel, or 
creating, testing, or maintaining its systems.”). 
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Prior minimization procedures under Section 702 did not have a comparable exemption 
for training, which the government proposed in March 2018 after numerous instances of queries 
conducted during training that did not comply with the FBI minimization procedures. See March 
27, 2018, Memorandum at 8 n.9, The Court notes that the practice of conducting queries of 
unminimized Section 702-acquired information that, do not meet the querying standard during 
training was not limited to isolated mistakes, see, e.g., Jan. 5,2018, Notice at 2; May 2,2018, 
Notice at 2, but appears to have been a systemic practice that went largely undetected for years. 
See Jan. 18, 2018, Notice at 2-3 (reporting that since 2011, a unit in FBI’s 




had been routinely conducting training sessions with FBI employees on the use 


of databases containing FISA-acquired information, including Section 702 information, during 
which trainees were asked to conduct queries using terms provided by the trainers, which 
generally involved the use of names of former subjects of FBI investigations as query terms). 

Amici objected to the provisions proposed in March 2018 insofar as they sought a 
wholesale exemption from *therwise-applicable querying, retention, and dissemination rules. 
See Amici Brief at 61-63, 82-84; Amici Reply at 13-16. Specifically, amici questioned whether 
effective training really required the use of U.S.-person query terms, see Amici Brief at 62, or 
departures from retention and dissemination standards. ]d. at 83. Amici also noted that “the 
procedures do not assign any responsibility for training, provide any guidance as to what it 
should entail, «r describe how it must be designed .. , .” Id. at 61. 

The government responded that queries “conducted for training purposes promote both 
the government interest in ensuring an effective workforce while simultaneously protecting the 
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interests of U.S. persons by reducing the risk of noil-compliant use or disclosure of sensitive 
data.” Gov’t Response at 19. That rationale was undercut by the breadth of the provisions, 
which by their terms were not limited to training that pertains to protecting U.S.-person 
information. The government also disclaimed any intent to use the exemptions to retain 
information otherwise subject to destruction requirements or to make otherwise prohibited 
disseminations. Id. at 41 -42. 

In response to concerns regarding the breadth of the proposed training exemption raised 
by amici and the Court, the government narrowed the training exemption in the procedures in 
three significant ways. First, the training exemption in the minimization procedures was 
narrowed to only permit deviations from procedures governing access and review of information, 
and limited those deviations to only those reasonably necessary for effective training. See, e.g.. 
September 18, 2018, NSA Minimization Procedures § 2(b) at 2; September 18, 2018, FBI 
Minimization Procedures § I.G at 4; September 18, 2018, NCTC Minimization Procedures § B.l 
at 5. The training exemption in the CIA minimization procedures was removed after the CIA 
determined that such an exemption was unnecessary. See September 18, 2018, Memorandum 
at 6. In addition, the government limited the exemption for training queries to queries the agency 
determines are necessary to the training of its personnel regarding proper implementation of 
FISA and FISA procedures, and to permit the use of U.S.-person identifiers to perform such 
queries only when there is a particular need to do so in the conduct of such training. .See FBI 
Querying Procedures § IV.C.l at 5; NSA Querying Procedures § IV.C. 1 at 4; CIA Querying 
Procedures § IV.C.l at 4; NCTC Querying Procedures § IV.C.l at 4. 
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These modifications appear to meaningfully limit the types of training activity exempted 
from otherwise-applicable rules. In light of the long-term non-compliance with the querying 
standard during training sessions conducted by the FBI’s 
however, it appears prudent to clarify the Court’s understanding of the limited exemption from 
the querying procedures sought for queries conducted using U.S.-person query terms deemed 
necessary for effective training. It is not apparent why U.S.-person ^uery terms that are known to 
objectively meet the general querying standard (i.e., reasonably likely to retrieve foreign- 
intelligence information or evidence of a crime) should not be used whenever U.S.-person query 
terms are necessary to effective training. Trainers should pre-select U.S.-person query terms 
known to return foreign-intelligence information to prevent any unnecessary querying of U.S.- 
person identifiers unassociated with national-security investigations. The deviation from the 
querying standard for training queries should be understood to permit the use of queries 
conducted for training rather than foreign-intelligence purposes, but which nevertheless are 
reasonably likely to return foreign-intelligence information or evidence of a crime. 

3. Exemptions for Responding to Congressional Mandates 
Each set of proposed minimization procedures includes new language regarding agency 
compliance with congressional mandates that would require the agency to deviate from 
otherwise-applicable rules. The new language describes the types of process that would trigger 
this exemption as “a subpoena or similar process consistent with congressional oversight. ” See 
September 18, 2018, NSA Minimization Procedures § 2(b)(3) at 2 (“Nothing in these procedures 
shall restrict: ... the retention, processing, analysis, or dissemination of information necessary to 
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comply with an order of a court within the United States or a specific congressional mandate, 
such as a subpoena or other similar process consistent with congressional oversight”) (emphasis 
added); see also September 18, 2018, FBI Minimization Procedures § I.G at 4; September 18, 
2018, CIA Minimization Procedures § 6.h at 4-5; Septanber 18, 2018, NCTC Minimization 
Procedures § A.6.d at 4. The proposed querying procedures also pennit queries the agency 
determines are necessary to comply with “a specific congressional mandate, such as a subpoena 
or similar process consistent with congressional oversight^]” NSA Querying Procedures 
§dV.C.3 at 5; FBI Querying Procedures § 1V.C.3 at 5; CIA Querying Procedures § 1V.C.3 at4;e 
NCTC Querying Procedures § IV.C.3 at 4. 

The Court has previously observed that procedures that pennit exemptions “based on 
unspecified mandates could undermine the Court’s ability to find that the procedures satisfy 
statutory requirements.” See April 26, 2017, •pinion at 53 (citing November 6, 2015, •pinion at 
22)e(internal quotation marks omitted). In approving this provision in 2015, the Courte 
emphasized that the language, which at that time referred to “specific constitutional, judicial or 
legislative mandates,” must be interpreted narrowly to include only those mandates containing 
language “that clearly and specifically requires action in contravention of an otherwise-applicable 
provision of the requirement of the minimization procedures.” and directed the government to 
report any action taken in reliance on this provision. See April 26, 2017, Opinion at 53 (internal 
citation omitted). 

The government sought to modify this provision in September 2016 to describe the 
contemplated activity requiring a departure as “necessary to comply with a specific congressional 
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mandate or order of a court within the United States.” See id. at 53-54. The Court approved the 
revised language but reiterated its expectation that the provision be narrowly interpreted, id,, and 
directed the government to provide prompt written notification of any instance in which an 
agency acted in contravention of otherwise-applicable minimization procedures in reliance on 
that provision. See id. at 96-97. 

To date, the government has not relied on the exemption for activities responsive to a 
specific congressional mandate. The government did, however, receive a congressional request 
to calculate the number of communications of U.S. persons that have been acquired pursuant to 
Section 702. That request, “was not in the form of a subpoena or other legal process” and 
therefore would not have constituted a legal mandate for purposes of the exemption. See id. 
at 54. The government asserted, however, that any action it undertook in response to the request 
in contravention of otherwise-applicable minimization requirements would be pennitted under 
the lawful-oversight exemption. Id. Although the Court believed both provisions could be 
clearer, it did not take issue with the government’s interpretation. The Court did, however, direct 
the government to provide prompt notification of any instance in which an agency acts in 
contravention of otherwise-applicable minimization requirements to respond to an oversight 
request from any outside entity other than the executive-branch entities specified in the 
procedures. See kL at 55,97. The government filed a notice of such actions taken in an effort to 
respond to the above-described congressional request. See Report on NSA Action Pursuant to 
Section 1 of Section 702 Minimization Procedures in Response to Oversight Request of 
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Congress, June 19, 2017 (advising that NSA conducted queries of Section 702 data in attempt to 
provide requested estimates). 

In response to the government’s March 2018 submission (which described the exempted 
activity as that “necessary to comply with a specific congressional mandate,” see, e.g., March 27, 
2018, NSA Minimization Procedures § 1 at 1), amici asserted that the exemption concerning 
congressional mandates did not adequately protect privacy interests because it was not clear 
whether a letter from a single member of Congress could be considered a mandate for purposes 
of the exemption. See Amici Brief at 67. Amici also recommended that the Court’s 
interpretation of the term as directives in “the form of a subpoena or other legal process” be 
added to the querying procedures. Id at 67-68. And, given the government’s historical intent to 
rely on the “lawful oversight function” exemption when a congressional request for information 
does not qualify as a “mandate,” amici argued that the congressional-mandate exemption 
appeared to be superfluous, unless it could be narrowed in a way that made it distinct from the 
“lawful oversight” exception. Id. at 68. 

In response to these concerns, the government proffered the revisions to the 
congressional-mandate language noted above - i.e. } adding the descriptor “such as a subpoena or 
other similar process consistent with congressional oversight” in both the minimization 
procedures and querying procedures. The Court believes that the requirement that such process 
be “consistent with congressional oversight” sufficiently circumscribes the type of mandate 
subject to the exemption. 
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The Court also believes that the modifications made to the lawful-oversight functions 
provision (discussed above) help clarify the respective spheres of that exemption and the 
exemption for specific congressional mandates: responding to a congressional request is not 
among the specified lawful-oversight functions, and the provision permitting deviations 
necessary to the conduct of unspecified lawful-oversight functions only applies to such functions 
of the agency over its personnel and systems. See, e.g.. September 18, 2018, FBI Minimization 
Procedures § I.H at 5. Should an agency rely on this provision to deviate from generally 
applicable rules to respond to a request from a member of Congress, it would be required to 
consult with NSD and ODNI beforehand and report promptly to the FISC the specific oversight 
activity involved. Id. § l.H at 5-6. Any such submission should also explain why the action 
taken constitutes lawful oversight of the agency’s personnel or systems. 

The Court is satisfied that the congressional-mandate provisions and 1 awful-oversight 
provisions of the procedures as now proposed adequately address the concerns raised regarding 
the potential breadth of the congressional-mandate exemption. Consistent with prior approvals, 
however, the Court will require the government to promptly report the circumstances of any 
deviation from applicable minimization or querying procedures taken in reliance on the 
congressional-mandate provision. 

E. Other Changes to the FBI Minimization Procedures 

The government proposes changes to the FBI’s minimization procedures concerning 
retention of Section 702-acquired metadata and retention of unminimized Section 702 
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each proposal below. 


information in copies of emails and instant messages in 



■he Court assesses 


1. Retention of Metadata 


In assessing the metadata proposals, it is useful to distinguish between provisions relating 
to the use of metadata for link analysis and those relating to queries for other purposes. 


Metadata Used for Link Analysis 


a. 


Section 1IJ.G.1 of the 2016 FBI Minimization Procedures currently exclude Section 702- 
acquired metadata in systems used solely for link analysis from the retention timetables that 
generally apply to raw Section 702 information in electronic storage. See 2016 FBI 
Minimization Procedures § II1.G.I at 22. The government seeks to modify Section Ill.G to 
permit the FBI to indefinitely retain such metadata for purposes of link analysis on all electronic 
and data-storage systems and ad hoc systems. See September 18,2018, FBI Minimization 
Procedures § II1.G.2 at 32. This change would harmonize the FBI’s Section 702 minimization 
procedures with a parallel provision of the FBI’s minimization procedures applicable to 
electronic surveillance and physical search under Titles I and III of FISA, which the Court 
approved in May 2016. See May 17, 2016, Opinion at 46-48. 

One incident of FBI over-retention of Section 702-acquired metadata was reported during 
the prior authorization period and is worth noting here. In implementing the change allowing 
indefinite retention of metadata acquired pursuant to Title 1 and III, the FBI mistakenly 
reconfigured its systems to eliminate the time limits on retention for all FISA-acquired metadata, 
including Section 702-acquired metadata that should have aged off systems not used solely for 
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link analysis. See Preliminary Notice of Compliance Incident Involving Retention of Raw 
Section 702-Acquired Metadata by FBI, April 27, 2018, at 2-3 (reporting improper retention of 
unminimized Section 702-acquired metadata that should have been purged from systems not 
solely used for link analysis within five years of expiration of certification under which it was 
obtained pursuant to Section 1II.G.1 of FBI’s current Section 702 minimization procedures). The 
FBI remediated the violation by limiting access to the over-retained Section 702-acquired 
metadata to a tool used solely for link analysis. See Supplemental Notice of Compliance Incident 
Involving Retention of Raw Section 702-Acquired Metadata by FBI, July 2,2018, at 2-3. That 
restriction would become unnecessary if the Court approves the proposed modification to Section 
III.G to permit indefinite retention of Section 702-acquired metadata on systems other than thosee 
used solely for link analysis. 

In support of the modification to the FBI Title I and III minimization procedures 
requested in 2016, the government argued that the limitations on retention periods for FISA- 
acquired metadata based on the nature of the system on which the metadata resides impaired the 
FBI’s ability to use metadata in data-storage systems not solely used for link analysis without 
commensurately increasing privacy protections, and that the ability to conduct link analysis of 
metadata in other systems would enhance the FBI’s capacity to make connections about targets 
and their networks. See Gov’t Mot. to Amend Standard Minimization Procedures for FBI 
Electronic Surveillance and Physical Search Conducted Under FISA, May 17, 2016, at 35-38. 

The Court concluded that the FBI’s compliance with the querying standard as well as other 
protections set forth in the applicable minimization procedures strikes a reasonable balance 


uni iiii n* 
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between the government’s foreign-intelligence needs and the protection of U.S. persons’ privacy, 
and approved the modification. Sge May 17, 2016. Opinion at 47-48. 

The government presents similar arguments now. See March 27,2018, Memorandum 
at 71-73. When evaluating the government’s current request to add Section 702-acquired 
metadata to the cache of information indefinitely retained on all electronic-data storage and ad 
hoc systems, the Court must consider the same governmental and privacy interests in relation to 
the protections afforded by the applicable procedures. 

The FBI’s procedures seek to protect privacy in a variety of ways. Most pertinent to the 
requested modification is the requirement that FBI personnel may only conduct queries of 
Section 702-acquired information that are “reasonably likely to retrieve foreign intelligence 
infonnation” or “evidence of a crime.” FBI Querying Procedures § IV.A.l at 3. That standard 
applies to queries of Section 702-acquired metadata, not just content information. (For reasons 
discussed in Part IV.B above, the Court has found the FBI’s querying practices deficient and is 
contemporaneously ordering the government to correct that deficiency.) In addition, any 
dissemination of metadata acquired under Section 702 that is of or concerning a U.S. person 
must meet the criteria of Section IV of the September 18, 2018, FBI Minimization Procedures, 
and disclosure for law-enforcement purposes must comply with Section III.H.2 of those 
procedures. 

Consistent with the May 2016 approval of the FBI’s standard minimization procedures 
for electronic surveillance and physical search, the Court finds that the FBI’s proposed Section 
702 minimization and querying procedures provide sufficient protection for U.S.-person privacy 


DATE: Oct 8, 2019 - Authorized Public Release 


Page 113 of 138 


FISC Opinion, Oct 2018 



Document regarding the Section 702 2018 Certification 


ODNI Authorized for Public Release 


uBCnBTn 

concerns related to the indefinite retention of Section 702-acquired metadata on all FBI data¬ 
storage and ad hoc systems when balanced against the important and substantial interests asserted 
by the government. The Court notes, however, that for purposes of evaluating Section 702 
minimization procedures, the diminished privacy interest in non-content information generally 
recognized (including by amici, see Amici Brief at 73), does not equate to no privacy interest. 
And, in a digital era in which U.S. persons share an expanded amount of data electronically, the 
type and volume of metadata associated with U.S. persons’ communications acquired under 
Section 702 may also expand. It is not unreasonable to expect that the type of metadata available 
for querying across all FBI data-storage and ad hoc systems, particularly when retained 
indefinitely and aggregated over longer periods of time, could provide a cache of information the 
use of which might implicate greater privacy concerns. Cf. Carpenter. 138 S.Ct. at 2215-17 (“the 
unique nature of cell phone location records” at issue distinguished it from other third-party 
records such as dialed numbers or negotiable instruments). Mindful of the need to consider the 
type and volume of metadata acquired under Section 702 and the manner in which the 
government uses such metadata when evaluating the sufficiency of the targeting, minimization, 
and querying procedures, the Court will require the government to describe the types of 
information acquired by the FBI under Section 702 that the government regards as metadata and 
the extent to which such metadata can reveal location information about U.S. persons, 
b. Metadata Queried for Other Purposes 
As noted above. Section III.G.l of the FBI’s current minimization procedures permits the 
indefinite retention of Section 702-acquired metadata only on systems used solely for link 
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analysis. Section 702 metadata stored on other systems must be aged off those systems pursuant 
to the same retention limits applicable to the contents of the corresponding communications. 
Specifically, information that has not been reviewed must be purged within five years of the date 
of expiration of the certification under which it was acquired, unless a specific extension is 
obtained. See 2016 FBI Minimization Procedures § III.G.l.a at 22. Information that has been 
reviewed but not identified as meeting the retention standard - /.<?., information that reasonably 
appears to be foreign-intelligence information, to be necessary to understand foreign-intelligence 
information or assess its importance, or to be evidence of a crime - must be access-restricted 
after ten years and purged after fifteen years, unless a specific extension is obtained. See id. 
§ein.G. 1 .b at 23. Information that is subject to those access restrictions may be queried, bute 
personnel must obtain approval from a desiprated FBI official before accessing the results of the 


query. 


The government has advised that it intends to implement the ten-year access-restriction 
provision (under both the FBI’s standard minimization procedures for electronic surveillance and 
physical search and its Section 702 minimization procedures) to allow immediate access to 
metadata responsive to a query, regardless of whether the query was run for purposes of link 
analysis or for other analytical purposes. See Letter Regarding FBI’s Implementation of Section 
III.D.4.C of Standard Minimization Procedures for FBI Electronic Surveillance and Physicale 
Search Conducted Under FISA, Feb. 5, 2018, at 2. The ten-year mark will be reached in 
November 2018 for data acquired under FISA Title I and Title III but not until September 2019 
for Section 702 information. Id. at 1 n. l, 2. The government also advised that if access to a 
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restricted communication is approved, the FBJ intends to make the communication, including the 
contents, accessible in a non-restricted state “to all users who would otherwise be authorized to 
access such information” in the pertinent system for six months or until fifteen years from the 
expiration of the authority under which the communication was acquired, whichever is sooner. 

Id. at 3. In order to fully assess the reasonableness of the intended action, FISC Presiding Judge 
Rosemary M. Collyer directed the government to, among other things, submit a written 
explanation of the basis for its assessment that access to the metadata results of queries that are 
not conducted for purposes of link analysis is permitted under the applicable retention limits and 
describe how metadata may be queried or analyzed for purposes of link analysis and how it may 
be purposes. See Docket Nos. Order, 

July 26, 201 8, at 3. The Court anticipates that the information regarding the actual 
implementation of these provisions provided by the government will significantly inform the 
Court’s evaluation of the reasonableness of the government’s actions in the context of Titles I 
and III and, beginning in ^^^^^^^^|under Section 702. 



2. Retention on Email and Insfant-Messa , 

The government seeks modifications to the FBI’s 702 minimization procedures that 
would permit, the FBI to retain unminimized Section 702 information in certain repositories that 
do not comply with the FBI’s current minimization procedures. The government seeks these 
modifications as part of an effort to address such noncompliance, which was first reported to the 
Court in the context of information acquired pursuant to Titles I and 111 of FISA in December 
2016. 
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In December 2016, the government informed the Court that FBI systems containing 
classified email and instant messages might be retaining unminimized FISA infonnation in 
violation of FBI’s standard minimization procedures. See April 26, 2017, Opinion at 88 n.70. In 
March 2017, the government identified the same systems as presenting compliance issues under 
the FBI's 702 minimization procedures. See Quarterly Report to FISC Concerning Compliance 
Matters Under Section 702 of FISA, Mar. 17, 2017 (“March 2017 Quarterly Report”) at 78-79.e 
According to that report, all email messages on the FBI's secret-level email system are 



etained i 



maintained by the FBI’ 


FBI in responding to discovery requests. Id Tha 
management and FOIA processing, and by the FBI’s 
investigative purposes. Id. 


C as>1 >-t the 

is also used for records 




is also storing instant messages from FBI’s 


secret-level instant-messaging system in a separate system used primarily for investigative 
purposes. See id. at 79. The April 26, 2017, Opinion directed the government to report the 
extent to which unminimized FISA, including Section 702, infonnation was being retained on 
those systems and to assess whether such retention complied with applicable minimization 
requirements; and to the extent that noncompliance was found, to describe the remediation steps 
the government was taking. See April 26, 2017, Opinion at 97-98. 

hi subsequent months, the government provided the Court additional details regarding the 
FBI’s retention of Section 702 and other FISA infonnation on those systems?and reported ane 

the FBI’s ^^^H^|^|was^^^^^^^instant 
messages on the FBI’s top secret enclave. See March 27, 2018, Memorandum at 80. In 
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December 201 7, the government notified the Court that the FBI intended to prohibit users from 


placing unminimized FISA-acquired infonnation in classified instant messages, but because FBI 


personnel needed the ability to include unminimized Section 702 and other FISA infonnation in 
classified emails, that practice would not be prohibited. See Supplemental Information 
Regarding Retention of Raw FISA-Acquired Infonnation in Certain FBI Special Purpose 
Systems, Dec. 14, 2017, at 2. The government further advised that the FBI was working on a 



solution that would require 


instant messages and emails (except for those subject to 


litigation holds) to age off within five years. See id. at 2-3. Recognizing these measures would 
not bring the FBI into full compliance with the minimization procedures, the government advised 
the Court it also intended to seek modifications to the applicable procedures. See id. at 3. 

In the March 27, 2018, Submission, the government proposed changes to the FBI’s 
current Section 702 minimization procedures. The first change would prohibit the further 
placement of unminimized Section 702-acquired information in classified-email and instant- 
message systems. See March 27, 2018, Memorandum at 81-82. Even though the FBI assesses 
there is still an operational need to place such information on classified email systems, the 
government is prepared to take that step because of its inability to delete information from the 
i •'■mail system and instant-message repositories in conformance with the generally 
applicable retention limits while still retaining infonnation subject to a litigation hold. See id. 
at 81-82. Because the non-compliant systems will not ingest any additional unminimized Section 
702-acquired information, the volume of information “over-retained” in those systems willa 
effectively be capped. 
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With regard to information already in ^^^^^^^mail system and instant-message 
repositories, the government contends that it is not currently possible to globally search for 
messages containing unminimized Section 702-acquired information. Id. at 82-83. The 
government therefore proposes two new provisions to the FBI’s Section 702 minimization 
procedures, which would permit the indefinite retention of unminimized Section 702-ac^uired 
information on these systems notwithstanding otherwise-applicable retention limits. See 
September 18. 2018. FI 



Systems”) (exempting those systems 


from specified retention rules). Although no maximum retention period would apply to either 
system, access to the databases would be limited to “FBI personnel who require access to 
perform their official duties or assist in a lawful and authorized governmental function, including 
system administrators and other technical personnel, and who have received training on these 
minimization procedures and the Querying Procedures.” Id. §§ III.F.5 at 30 and III.F.6 at 31, 

The proposed provisions also require that the FBI maintain records of all personnel who have 
been granted access to such repositories and all accesses to such repositories. Id at 30-32. 
Finally, FBI personnel authorized to access these repositories may do so only “to assist in 



investigations, and to respond to inquiries related to records management and discovery,” and 
may only query those systems to find and provide information, which may include raw FISA- 
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acquired information, in furtherance of such inquiries, functions, and investigations. ]d Any 

queries in those repositories must also comply with the querying standard described above. Id. 

Amici expressed several concerns regarding the government’s proposal, including lack of 
specificity regarding who may have access to ^^^^^^mail system and instant-message 
repositories, the purposes for which those repositories are used, and the justification for 
exempting them from U.S.-person masking requirements. See Amici Brief at 92-94. Amici also 
recommended that the FBI be required to provide a written statement justifying access, id. at 94. 

The Court shares amici ’s concerns to some extent but is also cognizant of the general 
nature and purpose of these systems, which do not include the retention of unminimized Section 
702 information in any amount approaching the quantity found in systems primarily used by the 
FBI for analytical and investigative work. In that light, the proposed modifications to the FBI’s 
minimization procedures greatly mitigate the potential impact of indefinite retention of 
unminimized Section 702 information in those systems. The necessity of categorically 
exempting them from any limits on retention, however, is not apparent. The Court will therefore 
approve proposed Sections 1I1.F.5 and IIJ.F.6 subject to the following: in the event the FBI 
recognizes unminimized Section 702-acquired information in a system defined by Section 1I1.F.5 
or I1I.F.6, and seeks to retain such information in that system, the government shall report in its 
next quarterly report concerning compliance matters under Section 702: (1) whether the 
information could be retained on an FBI classified-email or instant-messaging system as 
described in Section 11I.F.4, or in connection with litigation matters as described in Section 
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III.1.3; and (2) if not, the reason retention of the information in that system is necessary to the 
purposes served by the system. 

F. Conclusion 

For the reasons stated in Parts IV.B and 1V.C above, the Court finds that the FBI 
Querying Procedures do not comply with the recordkeeping requirement at § 702(f)(1)(B) and 
that, in view of the FBI’s querying practices, the FBI Querying Procedures and FBI Minimization 
Procedures do not, as implemented, satisfy the definition of “minimization procedures” at 5# 

U. S.C. § 1801 (h) and are unreasonable under the Fourth Amendment. 

In other respects, the government’s querying and minimization procedures, including 
those provisions examined in Parts IV.D and IV.E above, comport with applicable statutory 
requirements and the Fourth Amendment. In particular, the changes to the FBI Minimization 
Procedures that provide more detailed guidance on the storage and handling of information on 
various types of systems and related organizational changes to those procedures, see March 27, 
2018, Memorandum at 43-70, 74-75, present no impediment to making those findings. 

V. OTHER NON-COMPLIANCE 

Although the other instances of non-compliance reported by the government do not beare 
significantly on the Court’s disposition of these matters, it is desirable to touch briefly on the 
current status of two additional matters discussed in the April 26, 2017, Opinion, as well as two 
more recent matters. 
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A. Incidents Addressed in the April 26. 2017, Opinion 

Several significant compliance issues were addressed in the April 26, 2017, Opinion, four 
of which were not fully resolved at the time of the Opinion: (1) issues arising from NSA’s 
upstream collection of Internet communications, see April 26, 2017, Opinion, at 78-81; 

(2) eimproper disclosure of unminimized Section 702 information by the FBI, id, at 83-87;e 

(3) econcems about the frequency of NSA’s post-tasking review of contents, id at 75-78; ande 

(4) ethe potential over-retention of unminimized Section 702 information by the FBli 
Id. at 87*89. The first and fourth issues are discussed above in Part III.A and 

Part 1V.E.2, respectively. The other two are discussed briefly below. 

1. Frequency of NSA’s Post-Tasking Review of Contents 
NSA’s targeting procedures require that analysts take reasonable steps to confirm that a 
selector continues to be used by a non-U.S. person located outside the United States. Such steps 
may include content review, as well as ascertaining whether a tasked facility is being used inside 



procedures provide that content review “will be conducted according to analytic and intelligence 
requirements and priorities” and do not require analysts to review the contents of 


communications acquired from tasking a particular selector at fixed intervals. See id. at 7. The 
government has advised the Court, however, that NSA follows a policy whereby such content 

E ffer the first acquisition and at intervals of 


review is performed no later 
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no more thai fl^^^^^^^^Rereafter. See Update Regarding Post-Targeting Content 
Reviews, Sept. 13, 2016, at 2. 

As indicated in the April 26, 2017, Opinion, the Court has had concerns about the 
government’s ability to monitor analysts’ compliance with this policy. See April 26, 2017, 
Opinion at 76-77 (citing Supplement Letter Regarding Post-Targeting Content Reviews, Mar. 13, 


2017 (indicating that NSA ha 



'or monitoring compliance with the policy 


in only one of its Section 702 repositories and therefore does not comprehensively monitor or 
verify analysts’ compliance with the policy)). To address the Court’s concern, the government 
undertook to include in its quarterly reports any instances in which a failure to conduct timely 
content review in accordance with this policy was discovered, whether or not such failure 
resulted in a violation of the targeting procedures themselves (e.g., a delayed detasking resulting 
h orn the failure to conduct timely post-targeting content review). April 26, 2017, Opinion at 77. 

The information submitted in the six quarterly reports filed since April 2017 revealed 
several instances in which NSA did not comply with the policy, only a small fraction of which 
led to violations of the targeting procedures. See, e.n.. Quarterly Report to FISC Concerning 
Compliance Matters Under Section 702 of FISA, Sept, 14, 2018 (“September 2018 Quarterly 


Report”) at 97 (reportin 




jof failure to conduct timely post-targeting content review, 
jikely resulted in delayed detasking); see also Quarterly Report to FISC Concerning 
Compliance Matters Under Section 702 of FISA, June 15, 2018 (“June 2018 Quarterly Report”) 


at 101 (reporting 




rf failure to conduct timely post-targeting content review, 


ssociated with delayed detaskings); Quarterly Report to FISC Concerning 
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Compliance Matters Under Section 702 of FISA, Mar. 16, 2018, at 91 (reportin : 


failure to conduct timely post-targeting content review 



ssociated with 


delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section 


702 of FISA, Dec. 15, 2017 (“December 2017 Quarterly Report”) at 89 (reportin 


lot 


ssociated with 


failure to conduct timely post-targeting content review 


delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section 



702 of FISA, Sept. 15, 2017 (“September 2017 Quarterly Report”) at 81 (reporting ■ ‘./ 

of failure to conduct timely post-targeting content review, ^^^^^^^^^^ssociated with 
delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section 
702 of FISA, June 16, 2017 (“June 2017 Quarterly Report”) at 99 (reportin 
failure to conduct timely post-targeting content review ^^^^^^^^^^^Kssociatcdwitl 
delayed detaskings). 

The quarterly reports also revealed that in several of these incidents the CIA or the FBI 
was responsible for conducting post-targeting content review but did not conduct timely reviews. 
See, e.g., June 2017 Quarterly Report at 99 n.54 (identifying incidents for which FBI had 
responsibility for conducting timely post-targeting content review); September 2017 Quarterly 
Report at 81 n.39 (same); September 2018 Quarterly Report at 64 & n.40 (identifying incident in 
which CIA had responsibility for conducting timely post-targeting content review). 

In addition, in June 2018, the government notified the Court that because of reliability 
issues, NSA had disabled two features of the system used to remind analysts of their obligations 
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to conduct post-targeting content review. See Supplemental Letter Regarding Post Targeting 
Content Reviews, June 12, 2018, at 1. 

Despite these setbacks, the Court does not view the reported deviations from the policy as 
presenting significant concents, principally because (1) only a small fraction of the deviations 
from NSA’s post-tasking content review policy resulted in an improper delay in detasking; and 
(2)dhe number of missed or untimely reviews reported, regardless of whether a delay ine 
detasking resulted, is small when viewed in relation to the total number of current taskings. See, 
e.g. . September 2018 Quarterly Report at 1,97 (reporting^^^^^^^^^^^Hplities under 
task at any given time between June 1,2018, and August 31, 201 ^^^^Hailures to conduc 
timely post-targeting content review during the same period). The Court notes, however, that 
compliance with NSA’s post-targeting content-review policy remains an area susceptible to 
improvement. The government is encouraged to continue to explore additional means of 
prompting analysts to conduct the content reviews required by NSA’s policy and, to the extent 
the FBI or the CIA is responsible for conducting such review, to ensure compliance with the 
policy, The government is also expected to continue to report instances of non-compliance with 
the policy in its quarterly reports. 

2• Tmnrnner Disclosures of 1 by t he FBI 

The April 2017, Opinion also discussed 

unauthorized personnel to access Section 702 information, only one of which presented a 
continuing issue of concern to the Court. See April 26, 2017, Opinion at 83-87. That matter 
involved the provision of unminimized Section 702 information pertaining to 
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:ontractor that was developing software intended to facilitate review of 
Section 702 information. See Quarterly Report to FISC Concerning Compliance Matters Under 
Section 702 of FISA, Sept. 15, 2016, at 131. At the time of the Court’s April 2017 decision, 
etumed the information in question to the FBI, but the FBI still planned 
personnel to install the software on an FBI system. See April 26, 2017, Opinion at 86. The 
Court ordered the government to report (1) the results of an investigation it had undertaken to 
determine whether there were other instances of improper access or disclosures, and (2) to report 
the circumstancej^^^^^Jnticipated installation of the software on an FBI system, including 
whether its personnel received access to unminimized Section 702 information in the course of 
their work; and if so, an assessment whether such access complied with the FBI’s minimization 
procedures. See April 26, 2017, Opinion at 98. 

On June 8. 2017, the government reported that its investigation had revealed no 
additional instances of improperly accessed, unminimized FISA-acquired information on FBI 
systems between 2008 and March 2017. See Supplemental Response Regarding Improper 
Disclosures by FBI of Raw FISA-Acquired Information, Including Section 702-Acquired 
Information, June 8, 2017, at 2. The government i 
software and undertook to inform the Court of the 
at 4. 

The results of the FBI’s investigation reported in June 2017 eased the Court’s concerns 
regarding the possibility of further noncompliance with access restrictions. The FBI must, of 
course, report any future unauthorized access of Section 702 information; however, in the event 
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Software is installed in a manner fully consistent with the FBI’s minimization 


procedures, such installation need not be repotted to the Court. 

B. New Compliance Issues 

In addition to the incidents of non-compliance concerning querying practices and over¬ 
retention of Section 702-acquired information discussed above, the government has identified a 
number of other incidents of noncompliance with the applicable procedures. For example, there 
have been several instances in which NSA has tasked selectors under Section 702 without 
conducting the necessary foreignness checks, failing to perform timely fbreignness checks (i.e., 
the results of a foreignness check had grown stale by the time the selector was tasked), or failing 
to consider the totality of circumstances when making a foreignness determination. See, e.g.. 
September 2017 Quarterly Report at 6-41. In other instances, the government failed to timely 
detask accounts because of human error, staffing issues, communications failures between 
agencies, or misunderstandings of the rules. See, e.g., December 2017 Quarterly Report at 28-63. 
Notices filed over the last year also indicate that the FBI continues to encounter difficulty with 
the timely establishment of review teams, which its minimization procedures require when a 
Section 702 target has been charged with a federal crime, see, e.g.. Supplemental Notice of 
Compliance Incident Regarding Two Section 702-Tasked Facilities, Aug. 8, 2018; Rule 13 
Notice Regarding [Target and Multiple Docket Numbers] and Three Section 702-Tasked 
Facilities, Jan. 11, 2018, and that NSA continues to experience problems of varying magnitude 
with the over-retention of 702-acquired information on its many systems. See, e.g.. June 2018 
Quarterly Report at 85-87,93, 97. 
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After considering these and other incidents reported since April 2017, the Court finds 

reasonable and sufficient the steps taken by the government to address them and to prevent 
similar occurrences. It concludes that only one new incident and one potential compliance 
incident merit specific discussion here. 
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compliance to the FISC, the government frequently represents that information has been placed 



On May 25, 2018, the government reported to the FISC that, since September 2017, NS A 
had a growing backlog of purge-discovery orders, which resulted in significant delays in placing 
information on the MPL. Id. at 2. The majority of the backlogged orders pertained to Section 


702 collection which suggested that NS A was not timely complying 

with its purge obligations under the applicable Section 702 procedures. See, e.e.. 2016 NSA 


Minimization Procedures, as amended Mar. 30, 2017, § 3 at 4, 6-10, § 5 at 12, § 6 at 13-14. On 
May 29, 2018, Judge Collyer held a hearing to learn how the government proposed to address I 
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As of October 1, 2018, NSA has successfully automated its processing of purge-discovery 
orders in some but not all of its SSRs, and is processing new purge-discovery orders at a rate 
similar to its pre-September 2017 rate. See Ninth Update at 2. Accordingly, the NSA considers 
backlog to have been eliminated. The government has not yet, however, provided to 
the Court a proposed standard for determining whether a backlog in processing purge-discovery 
orders develops in the future. As a result, until the government is able to assure the Court that 
purge-discovery orders are being timely processed, NSA will continue to: (1) 




(2) provide bi-weekly reports with the number of 

pending purge discovery orders. See id. 

Based on the NSA. 5 s processing of previously backlogged purge-discovery orders and its 
bi-weekly checks and updates, the Court finds that the ^^^^^^^backlog issue does not 
impede a finding that the NSA’s purge procedures, as currently implemented, are consistent with 
statutory and Fourth Amendment requirements. 

2. Insider-Threat Monitoring 

In the March 27, 2018, Submission, the government informed the Court that it had 

■ 

identified certain insider-threat-monitoring activities, 

id the subsequent placement of that 

information into systems maintained by insider-threat personnel. See March 27,2018, 
Memorandum at 11. The government refers to those activities as “user activity monitoring” or 
“UAM.” See September 18, 2018, Memorandum at 24. 
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.. encounter raw section 702-acquired information” and “whether such activities implicate the 
section 702 minimization and querying procedures.” Id. at 27. The government’s submission 
also includes a timeline: (1) NSD has requested that the covered agencies provide information 
concerning the user-activity-monitoring practices that may implicate raw section 702-acquired 
information no later than November 1, 2018; (2) the government anticipates that it will conclude 
any subsequent investigation by mid-January; and (3) “[b]y the end of February 2019, the 
government intends to provide the Court with a written update on whether UAM activities at 
each agency implicate the section 702 minimization and/or querying procedures and, if so, the 
extent to which those procedures need to be amended in order to address those UAM activities.” 
Id. at 28. 

The timeline proposed by the government for its investigation of the reported practices 
appears reasonable, except to the extent it intends to delay reporting any discovery of actual 
noncompliance with applicable minimization or querying procedures. At present, the 
government has advised the Court only that user-activity monitoring may have resulted in 
violations of applicable procedures. Any confirmation of that concern should be immediately 
reported to the Court in accordance with Rule 13(b) of the Court’s Rules of Procedure, even 
though the Court anticipates that any report of such an incident may be limited in content until 
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the completion of the investigation described by the government. And, to the extent 
noncompliance with applicable procedures is identified, the government is directed to consider 
and address options other than amending the procedures to remediate the violations. 


V. CONCLUSION 


For the foregoing reasons, the Court finds thatie 

(1) eThe 2018 Certifications, as amended by the September 18, 2018, Submission, as welle 
as the certifications in the Prior 702 Dockets, as amended by those documents, contain all the 
required statutory elements; 

(2) eThe targeting procedures for acquisitions conducted pursuant to the 2018e 
Certifications, as amended, are consistent with the requirements of Section 712(d) and of the 
Fourth Amendment; 

(3) dtVith respect to information acquired under the 2018 Certifications, as amended, thee 
minimization procedures and querying procedures to be implemented by NSA, the CIA, and 
NCTC are consistent with the requirements of Section 702(e) and Section 702(f)(l)(A)-(B) 
respectively and of the Fourth Amendment; 

(4) eWith respect to information acquired under the certifications in the Prior Section 702e 
Dockets, as amended, the minimization procedures to be implemented by NSA, the CIA, and 
NCTC (to include, as referenced therein, the requirements of the respective agencies’ querying 
procedures) are consistent with the requirements of Section 702(e) and of the Fourth 
Amendment. (The Court makes no findings regarding whether any querying procedures, as 
applied to information acquired under the certifications in the Prior Section 702 Dockets, are 
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consistent with the requirements of Section 702(f)(1) because Section 702(f) only applies “with 
respect to certifications submitted under [Section 702(h)]... after January 1, 2018.” 
Reauthorization Act § 101(a)(2).); 

(5) eWith respect to information acquired under the 2018 Certifications, as amended, thee 
minimization procedures and querying procedures to be implemented by the FBI are consistent 
with the requirements of Section 702(e) and Section 702(f)(l)(A)-(B) respectively and of the 
Fourth Amendment, except insofar as they are inconsistent with (a) the recordkeeping 
requirement at Section 702(f)(1)(B) because they do not require the FBI to keep records of 
United States-person query terms used to conduct queries of Section 702 information in a manner 
that fairly identifies United States-person query terms as such or differentiates them from other 
terms used to query Section 702 information and (b) the requirements of Section 702(e) and 
Section 702(f)(1)(A) respectively and of the Fourth Amendment because they do not require 
adequate documentation of the justifications for queries that use United States-person query 
terms. In those two respects, the Court finds deficiencies in those procedures within the meaning 
of Section 702(j)(3)(B); and 

(6) eWith respect to information acquired under the certifications in the Prior Section 702e 
Dockets, as amended, the minimization procedures to be implemented by the FBI (to include, as 
referenced therein, the requirements of the FBI’s querying procedures) are consistent with the 
requirements of Section 702(e) and of the Fourth Amendment, except insofar as they are 
inconsistent with those requirements because they do not require adequate documentation of the 
justifications for queries that use United States-person query terms. In that respect, the Court 
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finds a deficiency in those procedures within the meaning of Section 702(j)(3)(B); and, 
accordingly, 

IT IS HEREBY ORDERED AS FOLLOWS: 

(1) The government’s request for approval of the March 27,2018, Submission, ase 
amended by the September 18, 2018, Submission, is approved in part and denied in part, as set 
out below: 

a. eThe 2018 Certifications, as amended, and the certifications in the Prior Sectione 
702 Dockets, as amended, are approved; 

b. eThe use of the targeting procedures for acquisitions conducted pursuant to thee 
2018 Certifications, as amended, is approved; 

c. eWith respect to information acquired under the 2018 Certifications, ase 
amended, the use of the minimization procedures and querying procedures to be implemented by 
NS A, the CIA, and NCTC is approved; 

d. e With respect to information acquired under the certifications in the Priore 
Section 702 Dockets, as amended, the use of the minimization procedures to be implemented by 
NSA, the CIA, and NCTC (to include, as referenced therein, the requirements of the respective 
agencies’ querying procedures) is approved; 

e. e With respect to information acquired under the 2018 Certifications, ase 
amended, the use of the minimization procedures and querying procedures to be implemented by 
the FBI is approved, except insofar as they (a) do not require the FBI to keep records of United 
States-person quezy terms used to conduct queries of Section 702 information in a manner that 
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fairly identifies United States-person query terms as such or differentiates them from other terms 
used to query Section 7#2 information and (b) do not require adequate documentation of the 
justifications for queries that use United States-person query terms; and 

f.e With respect to information acquired under the certifications in the Priore 
Section 702 Dockets, as amended, the use of the minimization procedures to be implemented by 
the FBI (to include, as referenced therein, the requirements of the FBI’s querying procedures) is 
approved except insofar as those procedures do not require adequate documentation of the 
justifications for queries that use United States-person query terms; 

(2) dSeparate orders memorializing the dispositions described above are being issuede 
contemporaneously herewith pursuant to Section 702(j)(3)(A)-(B); 

(3) eThe following provisions of the April 26, 2017, Opinion shall remain in effect for thee 
reasons stated therein. Prospectively, the government need not comply with reporting 
requirements imposed by the April 26, 2017, Opinion, except as reiterated below: 

a. eRaw information obtained byNSA’s upstream Internet collection undere 
Section 702 shall not be provided to the FBI, the CIA or NCTC unless it is done pursuant to 
revised minimization procedures that are adopted by the AG and DNI and submitted to the FISC 
for review in conformance with Section 702; 

b, e On or before December 31 of each calendar year, the government shall submite 
a written report to the FISC: (a) describing all administrative-, civil- or criminal-litigation 
matters necessitating preservation by the FBI, NS A, the CIA or NCTC of Section 702-acquired 
information that would otherwise be subject to destruction, including the docket number and 
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court or agency in which such litigation matter is pending; (b) describing the Section 702- 


acquired information preserved for each such litigation matter; and (c) describing the status of 


each such litigation matter; 

c. The government shall promptly submit a written report describing each 
instance in which an agency invokes the provision of its minimization or querying procedures 


providing an exemption for responding to congressional mandates, as discussed in Part IV.D.3 


above. Each such report shall describe the circumstances of the deviation from the procedures 
and identify the specific mandate on which the deviation was based; and 

d.e The government shall promptly submit in writing a report concerning eache 
instance in which FBI personnel receive and review Section 702-acquired information that the 
FBI identifies as concerning a United States person in response to a query that is not designed to 
find and extract foreign-intelligence information. The report should include a detailed 
description of the information at issue and the manner in which it has been or will be used for 
analytical, investigative, or evidentiary purposes. It shall also identify the query terms used to 
elicit the information and provide the FBI’s basis for concluding that the query was consistent 
with applicable minimization procedures. The government need not file such a report for a queiy 
for which it files an application with the FISC pursuant to Section 702(f)(2); and 

(4) For the reasons stated herein, the government shall comply with the followinge 
requirements: 


a.eThe government shall submit reports to the Court on a quarterly basis,e 


beginning not more than 90 days after the issuance of this Memorandum Opinion and Order, on 


ttsp ***m**r#**tm****VN*m tm mu 
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TOP OECnETtfBl^OnCOW/MOFOnW 

This report shall: (i) describe the 



(ii) explain how the government is ensuring that it will only acquire 
to a target 

describe methods the government is using to monitor compliance with the abouts limitatiorrj 

land report on the results of such monitoring; 
b. No later than ten days after tasking for upstream collection under Section 702 a 





|he government shall submit a notice to the Court. This notice shall: (i) describe 

(ii) explain comply with the abouts 

limitation; and (iii) describe steps that will be taken during the course of the proposed acquisition 
to only to or from 

authorized Section 702 targets; 

c.oBy January 31,2019, the government shall make a written submission: (i)o 

describing^^^^^^^^^^^^^^^^^^^^^t acquires 
providers under Section 702; and (ii) stating to what extent 

jerives from any communication^), and if so, whether those communication- 
authorized Section 702 targets. For any communications that 
jU authorized Section 702 target, the government’s submission shall describe the source 
and nature of those communications, to include a description of the parties thereto; 
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d.eBy January 31, 2019, the government shall submit a written report thate 
describes the types of information acquired by the FBI under Section 702 that the government 


regards as metadata and the extent to which such metadata can reveal location information about 


U.S. persons; and 

e.eln the event the FBI recognizes unminimized Section 702-acquired infonnatione 
in a system defined by Section 11I.F.5 or 1II.F.6 of its September 18, 2018, Minimization 
Procedures, and seeks to retain such information in that system, the government shall report in its 
next quarterly report concerning compliance matters under Section 702: (i) whether the 
information could be retained on an FBI classified-email or instant-messaging system as 
described in Section III.F.4 of those procedures, or in connection with litigation matters as 
described in Section III.1.3 of those procedures; and (ii) if not, the reason retention of the 
information in that system is necessary to the purposes served by that system. 


ENTERED this 


f ^ day of October, on 1 fi ® 
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